W32.Trojan.Gen false positives


I tried to submit this via a support ticket but it doesn't allow me to enter my password.
 
I uploaded one of the files, spriter.exe, to virustotal.com and it is only hitting on webroot so I'm thinking false positives.  Here is scan info from my log:
 
Mon 2017-04-24 16:03:51.0632 Performing cleanup entry: 8
Mon 2017-04-24 16:03:51.0927 End passive write scan (6 file(s))
Mon 2017-04-24 16:03:54.0036 Scan Started: [ID: 406 - Flags: 1575/128]
Mon 2017-04-24 16:04:35.0520 Infection detected: c:program filescanonprint studio procnpspapp.exe [MD5: CD90CC76609BEDB3C96D02A222840308] [3/00091411] [W32.Trojan.Gen]
Mon 2017-04-24 16:04:35.0520 Infection detected: e:steamlibrarysteamappscommoncommand modern air naval operationscommand.exe [MD5: 899C8F65A68D4338D6A0DA097A3EDDB1] [3/10081001] [W32.Trojan.Gen]
Mon 2017-04-24 16:04:40.0929 Infection detected: c:usersandroappdata
oaminggamemaker-studioyycwindowsuapexex86winuaprunner.exe [MD5: 20FBBF64F5E1DF867E0005AF031D6B19] [3/00080011] [W32.Trojan.Gen]
Mon 2017-04-24 16:04:50.0058 Infection detected: e:steamlibrarysteamappscommonattlezone 98 reduxattlezone98redux.exe [MD5: 0441A9C1B53AFB8FB5FF69F1AA03D9FD] [3/08080001] [W32.Trojan.Gen]
Mon 2017-04-24 16:04:56.0982 Infection detected: e:steamlibrarysteamappscommonspriterspriter.exe [MD5: 57B5433954076D20426A229E1BDC8D22] [3/00000001] [W32.Trojan.Gen]
Mon 2017-04-24 16:04:56.0982 Infection detected: e:steamlibrarysteamappscommoncommand modern air naval operationsgamemenu_cmanoautorun.exe [MD5: 5CEAC3EC1728E0C2926E3AD58A41D97C] [3/10081001] [W32.Trojan.Gen]
Mon 2017-04-24 16:04:59.0890 Infection detected: c:usersandroappdata
oaminggamemaker-studioyycwindowsuapexex64winuaprunner.exe [MD5: 9A0178B18C9DCE6589C8E6D1AC680207] [3/00090011] [W32.Trojan.Gen]
Mon 2017-04-24 16:05:00.0437 Scan Results: Files Scanned: 17929, Duration: 1m 6s, Malicious Files: 7
Mon 2017-04-24 16:05:00.0594 Scan Finished: [ID: 406 - Seq: 191448274]

37 replies

Userlevel 7
Badge +48
Between 12PM – 3PM MTN today Webroot falsely identified a safe file as a threat. Customers whose apps were trying to use this file during the 12PM-3PM MTN window could have received a red block screen and followed instructions to quarantine the good file.  To resolve the issue we need customers to restore the quarantined file. Please follow the steps below to un-quarantine and restore the file:
 
  1. Open the Webroot application by double-clicking the W icon found in the system tray at the bottom of your screen.
  2. On the Webroot home screen select “Scan My Computer.”
  3. Once the scan completes and you’re back on the Webroot home screen, click on the cog icon found next to PC Security. 
  4. Click the “Quarantine” tab.
  5. Note where the date and time of the files quarantined is shown on the right of the screen.
  6. Identify every file listed for Mon 2017-04-24 with a time stamp between 12PM – 3PM MTN
  7. Click the check box on the left hand side of the screen next to all the files you identified in step 6.
  8. Click the “Restore” button located in the bottom right of the screen to un-quarantine the file.
  9. When prompted “If you’re sure you want to roll back the selected entries…” choose “Yes”.
  10. Depending on how many files that are being restored this could take several minutes to complete the action.
  11. Return to the home screen and scan once more to make sure the issue is resolved.
Userlevel 7
Badge +48
We hear you @ and are working on this as fast as we can. We will update you as soon as we have more information. 
Userlevel 7
Thanks, @

Our Team is aware of the rule causing False Positives and is actively working now to resolve. Please stay tuned for updates.
Userlevel 7
Please restore the files from Quarantine to resolve this issue.
 
1. From the system tray, double-click the Webroot icon.
2. Click the PC Security gear icon.
3. Click the Quarantine Tab.
4. Select the items in question and press the blue arrow Restore button at the bottom right.
 
Run a scan after restoring the files from the Quarantine to confirm it has been resolved.
 
Business users please read here.
Userlevel 1
All reinstalled fine, THANKS!
Userlevel 7
Badge +48
@ Happy to hear that! 
Userlevel 7
Badge +48
Please see the most recent update here. We are closing that post to comments so that those who subscribe to it will only receive notifications when an official update is posted. Please continue the discussion in this forum. Thank you!
 
 
Userlevel 7
Badge +48
Hey everyone, we are aware of a rule change causing technical issues. Our team is working to restore functionality. We will provide updates as info becomes available.
 
Thank you for your patience and sticking with us while we troubleshoot this issue. 
 
More to come as soon as we have it. 
Userlevel 7
@, the entire Webroot organization is dedicated to addressing this issue. Webroot is rolling back the false positives and is making progress on a comprehensive resolution. Please ensure that all endpoints are on and connected to the internet to receive the automated fix. Please do not uninstall the product or delete quarantine. Business customers who would like to address the issue immediately can follow instructions posted on Webroot Support.
 
If you need additional assistance, please send our Team a support ticket to avoid heavy call volume.
Userlevel 7
Badge +62
Hi kentko,
 
I am getting False Positives as well...Maybe @ can advise here.
 
Here are my False Positives:
 

i'm getting Brutal Doom 64, one of my games and EVERYTHING involving SteamVR
Userlevel 7
Getting tyhe same re. about 25 .exes that I know are clean, and in fact have been on my system for some weeks now...so something gone a bit funny in the Cloud...I reckon.
 
Baldrick
Or a multi-million dollar company trying to conduct business and not able to because it has flagged server applications as malicious and quarantined them. I would have much rathered it be Rocket League not opening.
Userlevel 1
Is there a way to get all the false positives that have deleted automatically? This is going to be a nightmare for us otherwise.
Webroot -
Please at least provide what we should be making the policy set to to avoid the issue...
 
Steve
Userlevel 1
I've Shut down my Webroot until someone "official" posts it is fixed. The files it wiped on mine were from an install program and Ireinstalled it and all is good, just no AV.
Hey guys, we could really use some help getting just one machine working.  
 
We could then take it from there.
 
One of our client's primary applications was quarantined and it's not restoring.  
 
Please help!
 
 
Brought down one of my servers with Sage Businessworks installed. I was not able to restore from quarantine via web panel.. or either I didn't wait long enough. I ended up having to set the Endpoint as unmanaged and restore directly from the GUI on the server.
 
How long should have the restore have taken and I hope this gets fixed VERY quickly before it flags anymore of my servers as malicious.
 
What is everyone's recommendation about removing server files? Do you have it set to automatically resolve or just send the alert so that you can determine what to do with the file?
Badge +1
Major False Positives involving known good client applications...

i can imagine someone on break playing something like Rocket League and they get kicked off and Webroot locking them off the game
Same here. I was up to 83 false positives in c:windowssystem32 before I just gave up and disabled Webroot. Everything I submitted to VirusTotal showed up with old hashes and 0 hits, but re-analysing the exact same file showed only 1 new hit, which was Webroot.

I'm not sure what all it screwed up but one of the exes was needed to raise admin privileges. It finally had multiple scans going at once and just locked my PC for 20 minutes. That's when I just gave up, powered on, and disabled it. I have this deployed on hundreds of clients and servers at my company so I hope this doesn't wipe us out today.

It appears some update today has screwed things up badly.
 
Windows 10 64bit Faster insider ring.
FYI This is taking out all of the MSPs.  Specifically we are losing almost all .EXE files across all of our clients.
 
It is also hitting our management tools so this has the potential to become a huge labor issue.
 
Do you have any recommended policy settings that we can setup as a new policy to temporarily put a halt to them?
Userlevel 1
We are in teh same boat here...tons of false positives today. I has set it not to resolve by deletion..but who knows how long that will take. So far removed everything from updaters to database management tools. This is pretty awful. Really hope the restore from quarantine works. Noticed in the logs webroot also deletes registry and any associated config files as well for delete applications.
from the looks it's ALL OVER....random....i hope it doesnt....i dont have money to move to someone else ><
This is brutal. It's detecting all kinds of files and causing our clients major grief.  It's affect about eight of our managed clients.

Reply