False Positive on LibreOffice (Portable) 4.1.0.4 [ssleay32.dll SOLVED by db 1264]

[rjohnson]

I received what I believe is very likely a False Positive report on a .dll my PortableApps version of LibreOffice Portable 4.1.0.4 (Build ID: 89ea49ddacd9aa532507cbf852f2bb22b1ace28, from http://portableapps.com/apps/office/libreoffice_portable).

 

I had 1 copy of the file on my hard drive, 1 on my USB drive, and 1 on a backup drive.

 

Also, I had a copy of a LibreOffice .dll and .exe from a previous LibreOffice install stored in a "Malware Test Data" folder.

(They'd been reported by a previous IOBit Malware Fighter scan, so I moved them to that folder and reinstalled LibreOffice.)

 

See attached log file.

 

IObit Malware Fighter

OS: Windows 7

Version: 2.0.1.8

Define Version: 1261

Time Elapsed: 05:54:59

Objects Scanned: 735647

Threats Found: 5

Save Time: 8/17/2013 8:18:26 AM

|Name|Type|Description|ID|

Trojan.Spyware, FILE, G:\Movable SW\PortableApps\PortableApps\LibreOfficePortable\App\libreoffice\program\ssleay32.dll, 4097374

Trojan.Spyware, FILE, P:\Movable SW\PortableApps\PortableApps\LibreOfficePortable\App\libreoffice\program\ssleay32.dll, 4097374

Trojan.Spyware, FILE, Z:\Movable SW\PortableApps\PortableApps\LibreOfficePortable\App\libreoffice\program\ssleay32.dll, 4097374

Trojan.Dropper, FILE, Z:\Malware Test Data\20120730 Results\IOBit False Positives\LibreOfficePortable\gio-querymodules.exe, 4049863

Trojan.Spyware, FILE, Z:\Malware Test Data\20120730 Results\IOBit False Positives\LibreOfficePortable\ssleay32.dll, 4097374

[Cicely]

Hi rjohnson,

 

Thanks for your feedback.

 

To check whether they are false positives, please take the steps below to help us look into it.

 

• Upload the files that have been detected as threats to VirusTotal and supply the report link in your next post

• Also, ZIP the files and upload them to Wikisend and supply the link in your next post for us to further investigate.

 

You can use THIS post as an example.

 

Thanks in advance.

[rjohnson]

Here are the VirusTotal reports:

 

sleay32.dll is analyzed at

 

https://www.virustotal.com/en/file/05d65d1c9ea9e1c5e8fb05b75e1af7bb384b1a0bf11dc255276e4c0d66bd6e9e/analysis/

 

and gio-querymodules.exe is analyzed at

 

https://www.virustotal.com/en/file/34cf682d72b79aa9d3b60adb420e8a88c3f127ff186157ac5858d93067d5daa5/analysis/1377017321/

[Cicely]

Hi rjohnson,

 

Thanks for your fast reply.

 

It is found that other 3 product also report gio-querymodules.exe as threats. Thus, it might be threats not a false positive. Please be careful.

 

Yeah, sleay32.dll should be false positive. But you do not supply us the file. Please kindly send us the file to us to do test as the method in my last Post.

 

Thanks for support IObit.

[rjohnson]

I have a filtered Internet connection which won't allow me to read the "Terms & Conditions" for Wikisend.

 

Can I E-mail the file to you?

 

Thank you.

 

- Russell Johnson

[Cicely]

Hi rjohnson,

 

Thank you for your fast reply.

 

Ok, you can send me the file to support@iobit.com. Please tell that it is the file for false positive from Forum. Then, it will be easier for me to find out this file.

 

Thanks in advance. :-D

[rjohnson]

Cicely, I just E-mailed to support@iobit.com the 1 file (ssleay32.dll) I had mentioned in my post. As explained in the copy of the message I sent (below), that E-mail address won't accept an E-mail message with file gio-querymodules.exe (or a .ZIP file containing it) attached. - Russell Johnson -------- Original Message -------- Subject: [COPY] Re: FOR CICELY - File #2 for investigation by Cicely on "False Positive Reports by IObit Products" forum (http://forums.iobit.com/showthread.php?p=94888#post94888) Date: Wed, 28 Aug 2013 18:35:24 +0200 From: rj_iobit To: ephesians28bygraceareyesaved@verizon.net Sorry! My original E-mail didn't have the file attached. ​Please pass along the attached file (ssleay32.dll) for investigation by Cicely on "False Positive Reports by IObit Products" forum. (See http://forums.iobit.com/showthread.php?p=94888#post94888.) I tried sending the other file mentioned (gio-querymodules.exe) in the forum post, but your mail system wouldn't accept an .exe file as an attachment (nor a .ZIP file of the .exe file). Thank you. - Russell Johnson On 8/27/2013 6:17 AM, IObit.Com Forums wrote: > Dear rjohnson, > > Cicely has just replied to a thread you have subscribed to entitled - False Positive on LibreOffice (Portable) 4.1.0.4 - in the False Positive Reports by IObit Products forum of IObit.Com Forums. > > This thread is located at: > http://forums.iobit.com/showthread.php?t=15812&goto=newpost > > Here is the message that has just been posted: > *************** > Hi rjohnson, > > Thank you for your fast reply.. > > Ok, you can send me the file to support@iobit.com. Please tell that it is the file for false positive from Forum. Then, it will be easier foe me to find out this file. > > Thanks in advance. :-D > ***************

[Cicely]

Hi rjohnson,

 

Thanks so much. I have got the file and send it to our programmers.

 

The false positive about sleay32.dll will be removed in Database Version 1264.

 

Thanks again. Cheers. :-D

[rjohnson]

You're welcome.