Suspected false positive – Python 3.11.17 quarantined, unable to submit sample

Peterspain
Peterspain Posts: 1 Observer
in Device Protection

Hello F-Secure Team,

F-Secure has quarantined a python.exe executable created by uv during the installation of a legitimate Python development environment on Windows 11.

Detection: Drop.Win64.FakeProgSelfRun.1921630

Python version: 3.11.17

The underlying Python distribution was verified against official SHA-256 checksums.

The executable is currently quarantined, so I cannot upload it through the sample submission form.

I have also repeatedly attempted to contact support, but the chatbot returns a licensing error, even when I request a human representative.

Could an F-Secure representative please explain how to submit the quarantined file for false-positive analysis without restoring it or creating a permanent antivirus exclusion?

I can provide additional technical information privately if required.

Thank you.

Like Awesome

Answers

  • Ukko
    Ukko Posts: 4,126 Superuser
    edited October 23

    Hello,

    Could an F-Secure representative please explain how to submit the quarantined file for false-positive analysis without restoring it or creating a permanent antivirus exclusion?

    Sorry for my reply. I am only an F-Secure user.

    You can try and take a screenshot of a quarantined item (especially if its hash and file path visible; or any other information available in the "Quarantine" section or the list of Recent Events / notifications). Then, provide all the details and describe the steps to reproduce the situation in the "Details" forms by answering 'Yes' to "Do you want to give more details about this sample?".

    Such as when / how python.exe created by uv (because 'the way' could actually trigger this detection), versions / builds and so on.

    edited later: just in case, the page is: https://www.f-secure.com/en/support/submit-a-sample (for "File"-type); and I do mean: to upload "screenshot" instead of python.exe (quarantined file).

    // Drop.Win64.FakeProgSelfRun.1921630 sounds as a generic detection about rare or unknown 'applications' being dropped and autolaunched. Is it recently created/updated binary (python.exe 3.11.17)? Or is it always 'exclusive'?

    I mean, otherwise - the routine itself is matter. Based on its detection name - it is.

    I have also repeatedly attempted to contact support, but the chatbot returns a licensing error, even when I request a human representative.

    Are you still experiencing this problem?

    I just tried with InPrivate mode of Microsoft Edge; with this https://www.f-secure.com/en/support page and it was possible to skip Chatty Bob and got a Support Agent.

    Thanks!

    Like Awesome

Categories