McAfee blocks upgrade to Push2Run 4.2

[GordThompson]

Attempted to upgrade 4.0 to 4.2, but McAfee nixed it. First there was this message



followed by a McAfee pop-up saying that it had blocked an "attack". The following item is in quarantine:

Code: Select all

Item: Push2RunReloader.exe
Threat: Real Protect-LS!0C81B2F66311
Detected: 2022-01-30 4:32 PM
Status: Detected

[GordThompson]

(Post deleted.)

[GordThompson]

A workaround is to exclude the file

"C:\Program Files\Push2Run\Push2RunReloader.exe"

from real-time scanning using the instructions here.

That allowed the 4.2 upgrade to complete successfully.

[RobLatour]

Thanks for posting GordTompson

I will report this to McAffee as a false positive.

However, the Push2RunReloader.exe is required for Push2Run to work fully. More specifically, when you ask Push2Run to change administrative privileges or if the program needs to reload itself should it find your settings file has been corrupted.

I don't use McAfee myself (rather I use BitDefender), but I suspect you can either just un-quarantine it, or assuming McAffee is not blocking the Push2RunReloader.exe from release 4.1, as a temp workaround you should be able to:

1. install release 4.1

2. save the file c:\Program Files\Push2Run\Push2RunReloader.exe to another location on your computer

3. install release 4.2 using the approach GordThompson describes above

4. copy the file Push2RunReloader.exe that you saved in step 2 to c:\Program Files\Push2Run\Push2RunReloader.exe

[RobLatour]

Actually, before sending a note to McAffee I just rebuilt the exact same release:

Here are the associated VirusTotal scans for the rebuild:

Push2RunSetup.exe: https://www.virustotal.com/gui/file/1d8 ... ?nocache=1

Push2Run.exe https://www.virustotal.com/gui/file/d82 ... ?nocache=1

Push2RunReloader.exe https://www.virustotal.com/gui/file-ana ... YzODk1NA==

From these scans:

Push2RunSetup.exe is showing no false positives (as was the previous case)

Push2Run.exe is now showing 1 false positive (where it had previously shown none)

Push2RunReloader.exe is now showing 2 false positives (where it had previously shown 10 - although McAfee is not now, nor was in the previous release, one of the engines reporting a false positive)


Accordingly, I just replaced the v4.2 setup file created yesterday, with the one I just created this morning. If you download it, right-click on it, and select properties and then click on the 'Digitial signatures' tab, you will see it has a signed date of January 31st instead of January 30th.


Gord - if it is not too much trouble can you please see if McAfee is objecting to this release, and if yes I will forward the false positive report on to them.

[GordThompson]

McAfee seems to have no problems with the January 31 re-release of 4.2 (with no real-time scanning exclusions). Thanks!

[RobLatour]

Thanks again for reporting this Gord, and for the additional testing.

I've now reported the remaining false positives to Avira and VBA32.