PCMark v2.0.191 gives false virus warnings on some antivirus software

[UL_Jarnis]

We've just launched major update to PCMark 8 - v2.0.191

Unfortunately some less-than-great antivirus applications (F-Secure, BitDefender and Ad-Aware being the notable ones) are flagging the new spreadsheet test (libreofficeCalcTest.exe) with generic Trojan alert. We have reported this false positive to the companies involved. There is no virus in PCMark 8.

[Mc Back]

Hi
I got the varning that that file contained a Gen.Variant.Graftor.117156 virus.

[UL_Jarnis]

Yep, this is exactly the alert I was talking about.

Here is what VirusTotal says about the file

https://www.virustotal.com/en/file/526061db38f3ae4320daae5cd6ff01abf3b65423646f9b18d545bf3bbaa327f5/analysis/1389962928/

Note that most antivirus applications confirm that the file is clean. It is just a couple of minor antivirus apps and those few major ones I mentioned.

[SonicAndSmoke]

Avast 2014 is affected as well:

http://abload.de/image.php?img=avastpcmark94uxs.jpg

[UL_Jarnis]

Odd, VirusTotal didn't flag it. Will bug Avast about it as well then... Thanks for the report.

[DustoMan]

Symantec Endpoint Protection goes off also.

[UL_Jarnis]

Also have reported it to Symantec. Highly annoying.

[UL_Jarnis]

As an update, all major antivirus vendors with the exception of McAfee have already cleared this false positive;

https://www.virustotal.com/en/file/526061db38f3ae4320daae5cd6ff01abf3b65423646f9b18d545bf3bbaa327f5/analysis/1390083491/

Symantec, Trend Micro and McAfee also seem to be complaining about sellangmsi.dll which is component of the LibreOffice build that is built into PCMark 8 but like the other one, this is also a "generic" detection based on heuristics and definitely a false positive. Hopefully they can sort it out soon enough.

If anyone is seeing any other antivirus warnings, let us know - and include details as to which file is causing the red flag.

[Monarch]

Zone alarm popped it as well

[{P4TM} Chef]

Time to alert them again? I have had both installed for many months so perhaps you updated recently. Symantec NSS just removed:

Filename: sellangmsi.dll
Threat name: Suspicious.Cloud.5
Full Path: d:\program files 2\steam\steamapps\common\pcmark 8\bin\libreoffice\program\sellangmsi.dll

File Actions

File: d:\program files 2\steam\steamapps\common\pcmark 8\bin\libreoffice\program\ sellangmsi.dll Removed
____________________________


File Thumbprint - SHA:
a54d92cef8d7862e4c0b9acff6cc938bacff2ab525c62588a9fd2ab705fe961e
File Thumbprint - MD5:
Not available

[UL_Jarnis]

*sigh*... yes, PCMark was just updated and I guess the oh-so-reliable heuristics are again at play...

Will poke Symantec.

[UL_Jarnis]

Symantec has been poked about this.

VirusTotal states that it is the only application that gives this false detection, as you can see here;

https://www.virustotal.com/en/file/a54d92cef8d7862e4c0b9acff6cc938bacff2ab525c62588a9fd2ab705fe961e/analysis/

[Sir Baracuda]

zone alarm now alerted 31.12.2019 cen you report them to