Community


Ru 6.9 detected by Mcafee EndPoint Security

Links used in this discussion
barced, User (Posts: 4)
Nov 05, 2018 5:25:30 am EST
Support level: Starter
RU 6.9 Viewer is detected by Mcafee EndPoint Security 10.6.1 - the event registered is "Threat Prevention False Positive Mitigation"
Conrad, Support (Posts: 3074)
Nov 05, 2018 7:04:42 am EST
Hello Barced,

Thank you for the report. We will immediately contact McAfee and submit a false positive removal request.
barced, User (Posts: 4)
Nov 13, 2018 10:35:02 am EST
Support level: Starter
Hi,

After a few days, mcafee endpoint  is finding rutviewer.exe as a threat again.

Thank you
Conrad Sallian, Support (Posts: 3074)
Nov 13, 2018 2:38:46 pm EST
Hello,

Thank you for your message.  

So they are detecting the same file with the same hash and signature all over again :) We can only hope that they are much better at detecting viruses and trojans than at not detecting legitimate software.
Hugo G, User (Posts: 1)
Dec 04, 2018 1:46:38 pm EST
Support level: Free or trial
What can be done? With version 6.9 detects it as a virus, can no longer be used if I have the antivirus McFee.

Help me!!!!! :(
Attached Files
Ru 6.9 detected by Mcafee EndPoint Security
Conrad Sallian, Support (Posts: 3074)
Dec 04, 2018 4:28:37 pm EST
Hello Hugo,

Thank you for your message.

We participate in McAfee whitelisting program and provided all our program files to them. They said they whitelisted them. We immediately inform McAfee whenever they falsely detect our software as malware and they report that they fixed the issue. For example, it was just a few days ago that there was yet another false positive that they said they fixed.

Pardon my sarcasm, but what makes users ask us for help in this situation, and not ask McAfee to help? How can we help if an antivirus software company falsely detects a legitimate and digitally signed file (the same file, not even changed) again and again? It's them, not us who mistakenly detect and remove legitimate software from your computer.

Please, don't think that we don't want to help you. We do. But we can only help with matters that we have at least some control over.
barced, User (Posts: 4)
Dec 05, 2018 3:47:42 am EST
Support level: Starter
Hello Conrad,

first of all, thank you for your support. It's very appreciated.

In order to respond to your legitimate sarcasm, I'll tell you that I opened a support request with mcafee on 21 November. I submitted a "false positive" request on rutview.exe file. That request is still open without any response.

In my specific case, I asked for help to both parties, as we have a solid security policy based on Macafee products ( about which we are satisfied as far as
security is concerned); however, if this problem is not completely solved we will be forced to choose a different product for remote assistance, much to our regret,
considering that RU is a very, very good product.

I anyway still wonder why so many antivirus products detect RU as a threat.

Thanks in advance for your support.

Best Regards
Conrad Sallian, Support (Posts: 3074)
Dec 05, 2018 4:46:52 am EST
Hello Barced,

In order to respond to your legitimate sarcasm, I'll tell you that I opened a support request with mcafee on 21 November. I submitted a "false positive" request on rutview.exe file. That request is still open without any response.

I am sorry to hear that. But this is also beyond our control. We cannot make McAfee become more customer-oriented overnight even if we wanted.

In my specific case, I asked for help to both parties, as we have a solid security policy based on Macafee products ( about which we are satisfied as far as
security is concerned); however, if this problem is not completely solved we will be forced to choose a different product for remote assistance, much to our regret,
considering that RU is a very, very good product.

Thank you for the kind words. Actually, we are very sorry to hear that antivirus software companies care so little about their customers' business.

I anyway still wonder why so many antivirus products detect RU as a threat.

I'm afraid you are exaggerating. Here is a current VirusTotal report on rutview.exe (version 6.9, the current one).

Rising is a Chinese antivirus that are really hard to get in contact with. As for Yandex, this is a Russian web browser "antivirus engine" that we still can't make stop detecting our software despite the fact they we contacted them and they said that they are working on the problem.

Thanks.

P.S. Sorry, modified the post since the VirusTotal link just wouldn't work properly. Now it works ok through a URL shortener.
barced, User (Posts: 4)
Dec 06, 2018 3:48:19 am EST
Support level: Starter
Hello Conrad,

I don't know how VirusTotal works, but that report doesn't reflect the reality.

Mcafee is listed as "clean" but despite this RUviewer.exe is still identified as a threat on our systems (to be more precise: it is identified as "Threat Prevention False Positive Mitigation").

However: I'm doing all I can in order to resolve this issue. If there is more I can do, please let me know.
Conrad Sallian, Support (Posts: 3074)
Dec 06, 2018 4:50:31 am EST
Hello,

I don't know how VirusTotal works, but that report doesn't reflect the reality.

From our past experience this report is very close to reality. Whenever there was a complaint by a customer that this or that a/v engines falsely detects the product, the detection was also present on VirusTotal.  

Mcafee is listed as "clean" but despite this RUviewer.exe is still identified as a threat on our systems (to be more precise: it is identified as "Threat Prevention False Positive Mitigation").

There might be two reasons - either you have outdated signature/definitions databases or this is a different McAfee product, not the one listed on VirusTotal.

However: I'm doing all I can in order to resolve this issue. If there is more I can do, please let me know.

The only way to resolve this, in the end, is to contact McAfee and ask them to remove this detection. No amount of our discussion or willingness to help on our end can help fix this problem :)

* Website time zone: America/New_York (UTC -5)