Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 3 replies
  • Answers 1 answer
  • Subscribers 3 subscribers
  • Views 7552 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

False positive for our software QueryStorm

Antonio Nakic-Alfirevic

Hi,

We're getting false positives for our software QueryStorm.

Specifically, this installer for the "Runtime" component is getting flagged:

https://qsfilestorage.blob.core.windows.net/installers/QueryStormRuntime_2.7.8337.21111.msi

The false positive is most likely due to a library we use called ExcelDNA which has been plagued by false positives in the last year:

Major Virus guards detecting the ExcelDna.xll as MSIL/TrojanDropper.Agent.FGU and deleting! · Issue #403 · Excel-DNA/ExcelDna (github.com)

I'd like to ask that our software be whitelisted, ideally at the level of our code signing certificate as we periodically release new versions of QueryStorm. 

Please advise if this is possible and how to proceed.

Thanks,

Antonio Nakic-Alfirevic

Owner, Windy Range Software d.o.o.



This thread was automatically locked due to age.
Parents
  • 0

    Hello Antonio, 

    Thank you for reaching the community forum. About this FP that you're getting on your application, I would like you to submit a sample submission request through our sample submission portal.. Ensure to zip the folder and provide the details of the detection that your getting. 

    Glenn ArchieSeñas (GlennSen)
    Global Community Support Engineer

    The New Home of Sophos Support Videos!  - Visit Sophos Techvids
  • 0 in reply to GlennSen

    Hi Glenn,

    Thanks for the reply.

    I submitted our installer via that form two days ago but have not heard anything back.

    Questions:

    - I submitted the .msi file but did not zip it. Is it important that I zip the installer before submitting it?

    - How long is the usual wait time for this? 

    I'm receiving numerous false positive reports from customers and would like to clear this up as quickly as possible. I can provide any information needed from my end.

    With regards,

    Antonio Nakic-Alfirevic

Reply
  • 0 in reply to GlennSen

    Hi Glenn,

    Thanks for the reply.

    I submitted our installer via that form two days ago but have not heard anything back.

    Questions:

    - I submitted the .msi file but did not zip it. Is it important that I zip the installer before submitting it?

    - How long is the usual wait time for this? 

    I'm receiving numerous false positive reports from customers and would like to clear this up as quickly as possible. I can provide any information needed from my end.

    With regards,

    Antonio Nakic-Alfirevic

Children
  • 0 in reply to Antonio Nakic-Alfirevic

    Hello Antonio, 

    The file that you're going to submit should be zipped for our lab's team to analyze the file. Submitting an MSI file may not be entertained by our lab's team due to security purposes. I would suggest you re-submit the said sample file in a zip. 
    Standard processing for a file submission would be 3-5 working days. 

    Glenn ArchieSeñas (GlennSen)
    Global Community Support Engineer

    The New Home of Sophos Support Videos!  - Visit Sophos Techvids
Unfiltered HTML