Mal/Dropper-O - App from Windows App Store

Hi Aaron,

Can you confirm the name of the file you submitted so I can find it on our system please.

Hi Peter,

The name of the file was - 3D4Medical.comLLC.CompleteAnatomy.exe

It is being identified as Mal/Dropper-O even when we open the folder of the file.

Thanks I have found it. I can see we are indeed detecting it as are a couple other AV vendors. We are looking into exactly why it gets detected at the moment. I will let you know if we think this detection is incorrect.

Hi Aaron,

We have now confirmed the detection is incorrect. The file is not malicious and an update to stop it being detected will go out shortly (probably next 6 hours). Thank you for bringing it to our attention.

Hello,

We are still having the same issue with Sophos Antivirus. The application is still being detected as malware which it is not.

Can you please confirm if the application has been whitelisted?

Aaron,

we whitelisted this file https://www.virustotal.com/#/file/7237f5718828523144665e46255dd4201c0de47bb473b68c3b609a48543690b9/detection

which is the one you sent us. 

If you are still seeing files detected try uploading them to virustotal.com first and see if it is this same file (hashes need to match). 

Hi Peter, it is still being flagged as a threat for me also.  The home console labels it as:  Mal/Dropper-O Threat partially cleaned

I uploaded "3D4Medical.comLLC.CompleteAnatomy.exe" to virustotal and it did have a different hash to your link above.  It still returned a green tick for Sophos, though I'm not sure if Sophos Home AV engine is identical with the Sophos on this site.

Clicking the link you posted above shows 2 vendors detecting it negatively as below:

Hope this may help

Can you take a screenshot or copy and paste the detection you are getting, does it give details of exactly what file and it's location is being detected?

The VT link you provide shows a file that does not look like it is being detected by us.

I just took a screen shot for you and realised that there is a number different in the file path of the alert and the current location.  My folder is now named _3.4.2.0 and not _3.4.1.0 as shown in the Sophos alert, so I assume the app had an update since this detection, hence virustotal not detecting it the same.  I will click Ignore to clear the alert.

Thanks for your quick reply.

I just took a screen shot for you and realised that there is a number different in the file path of the alert and the current location.  My folder is now named _3.4.2.0 and not _3.4.1.0 as shown in the Sophos alert, so I assume the app had an update since this detection, hence virustotal not detecting it the same.  I will click Ignore to clear the alert.

Thanks for your quick reply.