Is This A False Positive?

[Kieran]

Hi guys,

 

I work in tech support and have a client reporting that the Immunet is detecting one of our css files as a virus.

 

I'm told a threat from screen.css is quarantined.

 

Can any of you fellow Immunet users replicate this?

 

This file is certainly not a threat, do we have any idea why it might flag this alert?

 

Thanks for your help,

Kieran

[ritchie58]

Hi Kieran, it would have been best if you'd posted in the False Positives section regarding this topic but that's ok.

If it's possible to get the SHA256 hash we can white-list the file if it proves to be a FP. We do have a submission site for false positives at this link. http://support.immunet.com/index.php?/topic/3258-how-to-submit-a-false-positive-updated-instructions/
 

For now if your client wishes to use the program & you're sure it is simply a FP use Immunet's Restore feature for the file. Open the UI -> click on Quarantine located below and to the right of the History tab -> find the file and click on it -> this gives you the option of deleting or restoring the file, choose Restore. This will automatically move the file to the Exclusion list and will no longer be scanned.

 

As always, I'd like to remind all users to only restore a file you are "absolutely sure" is a false positive or you could be giving malware access to your system.
 

Cheers, Ritchie...