Trend Micro antivirus flagging Everything as 'spyware' :-(

[StanJ]

Apparently a new update to Trend Micro has decided that Everything is spyware.

It seemingly flags it due to FileSearcher.c as far as I can tell from Trend's pitiful logs.



It deleted the installer off of my system, and looks like it also deleted the executable from someone else's system, as I know she's been using a fairly recent version of Everything (downloaded within the last 6 months).

One of our IT guys googled something else and said 'Try this one instead'. Yeah, thanks for your weak effort, but NOT interested! I've been happy with Everything for about 10 years, and have no interest in some other off-brand search tool.

Any chance you folks could contact Trend Micro and get Everything whitelisted? Yeah, I know it's a pain dealing with them, but I can't do much as an end-user. My word that Everything isn't spyware doesn't hold much weight. An established company that's been around since 2004? should tell them that you fine folks don't distribute malware.

[horst.epp]

I guess you can itself Whitelist Everything in your Trend Micro client.
Also Virus Total doesnt' complain about actual Everything.exe in none of its 72 scanners including Trend Micro.
https://www.virustotal.com/gui/file/78b ... /detection

[void]

Thank you for your post.

Everything does not contain any spyware.

The latest build is currently not flagged.

I'm reaching out to Trend Micro..

[Alister]

Trend Micro just removed Everything from my machine, but in my case it called it PUA.Win32.FileSearcher.D

Trend Micro is absolutely notorious for spurious false positives and they never seem to learn, they do it over and over again to the same software. I would strongly encourage anyone who has any say in such things to make sure they don't use Trend Micro.

[Alister]

Oh, I see it did PUA.Win32.FileSearcher.C back on July 10. That was just the installer, whereas this was was the installed program.

[void]

My guess is someone is doing something malicious with Everything 1.4.1.969.

I've updated the installer to version 1.4.1.986.

Please make a false positive report on Trend Micro's website:
https://success.trendmicro.com/smb-new-request
Select Threat Issue
Select File False Positive.

[Alister]

I would, except it requires a sample to be uploaded, and I don't know where to find the sample, since TM "cleaned" it. Also I suspect I wouldn't be able to fill in everything on the customer information tab... guess I need to see if our IT are feeling more helpful than usual.

[maphew]

I tried to report the false positive but am unable to complete the form at step two. This step asks for the product name and version, and the product we are using is not in the list. The only Apex One listed is for MacOS. I tried using that product, plus a couple of other ones, but no go. The blocker is the mandatory "Product Activation Code" field. I don't have this since our scanner is installed on our machines from central IT by group policy. I tried to spoof the activation code with "000" and '123" etc. That let me get to Step 3, but whenever I tried to finish the submission it refused, saying I hadn't completed all the mandatory fields.

Our scanner info:

Apex One Security Agent
Agent version: 14.0.2170
Virus scan engine: 12.000.1008
Last updated: 2020-23-07

I did learn something though: it's only the 64bit version of Everything that is being flagged (by our scanner anyway). I am able to install and use x86 Everything.exe (on 64bit Win10 Enterprise build 1909).

[void]

Thanks for the information.

Please politely let Trend Micro know Everything from voidtools is not unwanted by submitting a ticket.

[Alister]

I did learn something though: it's only the 64bit version of Everything that is being flagged (by our scanner anyway). I am able to install and use x86 Everything.exe (on 64bit Win10 Enterprise build 1909).

The issue I found is that I had it configured to index network folders and after installing it doesn't remember these. Not sure if this was caused by Trend deleting the settings, or what

[void]

Please see the main thread for more information:
viewtopic.php?f=2&t=9214