[GoG] False positive on a game zip file and it's respective setup.exe file

[Newbie12]

Hi, I found another false positive a couple or so days ago(after having done a full system scan - as I haven't done that in ages). It was confirmed with Virustotal.com(apparently one said something on that but that's also a false positive that they'll have to fix) and GoG support tech that no games they host contains any virus/malware as they've obviously check them before releasing them for download. Therefore this must be a false positive. Please take a look at attachment for illustration purposes.

Edited January 30, 2016 by Newbie12

[SAS Malware Research]

Hello Newbie12,

 

In order to investigate this false detection I'll need some more information. Could you post the VirusTotal link?

 

Gabe

[Newbie12]

Hello Newbie12,

 

In order to investigate this false detection I'll need some more information. Could you post the VirusTotal link?

 

Gabe

Here: https://www.virustotal.com/en/file/2d7a0337c13247ca43e64297d8e703f722fb52e1e70d7d0e669a7cffdc682627/analysis/, that should be it as it is the same SHA256 hash I put in the file name of my thread post(too lazy to go and find the file(it's on another computer which isn't turned on and it's not my laptop either) and re-upload to scan ). And this is the exe file in the zip folder: https://www.virustotal.com/en/file/ef4990cfbaedb659e1cfdf04a3bab703644b38f730925dd66df04c40eb466339/analysis/ I didn't re-scan it, only did the zip file it was in. But SUPERAntiSpyware picks it up if I do a scan on the zip file.

 

Would you like me to upload and re-scan the two files(the zip file and the exe file within the zip file)?

[SAS Malware Research]

Hey Newbie23,

 

Thanks for the link. I believe I have found the cause of the false detection.

 

I've adjusted the database and this file should no longer be detected as of database version 12383 (which I am releasing within the next hour).

 

Update to version 12383 and scan again (a restart of SAS may be necessary).

 

Please let me know if this solves the issue, or if you have any other questions or concerns,

 

Gabe