emule v0.60a false positive

[zabadoh]

I tried to submit this to https://www.immunet.com/false_positive

But after hCaptcha, I get an error page that says "We're sorry but something went wrong"

Here's the data that I submitted to the page:

OS Version: Windows 7 Home Premium SP1

Immunet version: 7.3.2.11960

Sha256 of file causing FP :  ef 3d 6f 47 5b 1f 5c 5f 1c 55 94 e7 83 10 cf b2 63 f1 a9 7c d9 6a 62 e7 a2 8d e9 cd 44 d9 75 ec

Alert name: W32.MAP.Ransomware.rwd

Description of False Positive (500 characters) :  I have been running eMule for the past month or so.  Today after the latest update, I am getting a false positive when attempting to run eMule.

eMule is an open source filesharing program. I am running eMule v0.60a which is available from this page: http://www.emule-project.net/home/perl/general.cgi?rm=download

 

 

emule.exe

[ritchie58]

Hey zabadoh,

I am aware that the FP reporting URL is not working correctly because other users have reported the same thing in the recent (and not so recent) past. I've tried to contact support on several occasions to inform them of this issue but it 'still goes unresolved' unfortunately. It is my opinion that Cisco has made Immunet an 'extremely low priority' and continues to do so at this time.

I know there's a pandemic going on but other AV companys don't seem to have problems providing it's users with continuing professional technical support or keeping their sites error free & operational. " I find that very frustrating & disconcerting indeed!!!"

"I'm just the site's moderator & do my best to fill in as a support person when need be for more months than I care to count now!"

My advice would be to try and use the Restore feature for the file(s) associated with the program that were quarantined and then create a custom Exclusion rule for "eMule's entire Program Files folder" if your sure that there is nothing malicious about the app. 
 

If you have any questions about creating custom Exclusion rules with Immunet or using the Restore feature let me know by adding an additional thread to this topic.

Best wishes, Ritchie...