Suspected false positive – Python 3.11.17 quarantined, unable to submit sample

Peterspain
Peterspain Posts: 2 Observer
in Device Protection

Hello F-Secure Team,

F-Secure has quarantined a python.exe executable created by uv during the installation of a legitimate Python development environment on Windows 11.

Detection: Drop.Win64.FakeProgSelfRun.1921630

Python version: 3.11.17

The underlying Python distribution was verified against official SHA-256 checksums.

The executable is currently quarantined, so I cannot upload it through the sample submission form.

I have also repeatedly attempted to contact support, but the chatbot returns a licensing error, even when I request a human representative.

Could an F-Secure representative please explain how to submit the quarantined file for false-positive analysis without restoring it or creating a permanent antivirus exclusion?

I can provide additional technical information privately if required.

Thank you.

Like Awesome

Answers

  • Ukko
    Ukko Posts: 4,133 Superuser
    edited October 23

    Hello,

    Could an F-Secure representative please explain how to submit the quarantined file for false-positive analysis without restoring it or creating a permanent antivirus exclusion?

    Sorry for my reply. I am only an F-Secure user.

    You can try and take a screenshot of a quarantined item (especially if its hash and file path visible; or any other information available in the "Quarantine" section or the list of Recent Events / notifications). Then, provide all the details and describe the steps to reproduce the situation in the "Details" forms by answering 'Yes' to "Do you want to give more details about this sample?".

    Such as when / how python.exe created by uv (because 'the way' could actually trigger this detection), versions / builds and so on.

    edited later: just in case, the page is: https://www.f-secure.com/en/support/submit-a-sample (for "File"-type); and I do mean: to upload "screenshot" instead of python.exe (quarantined file).

    // Drop.Win64.FakeProgSelfRun.1921630 sounds as a generic detection about rare or unknown 'applications' being dropped and autolaunched. Is it recently created/updated binary (python.exe 3.11.17)? Or is it always 'exclusive'?

    I mean, otherwise - the routine itself is matter. Based on its detection name - it is.

    I have also repeatedly attempted to contact support, but the chatbot returns a licensing error, even when I request a human representative.

    Are you still experiencing this problem?

    I just tried with InPrivate mode of Microsoft Edge; with this https://www.f-secure.com/en/support page and it was possible to skip Chatty Bob and got a Support Agent.

    Thanks!

    1Like 1Awesome
  • Peterspain
    Peterspain Posts: 2 Observer

    Hi Ukko,

    First of all, thank you very much for taking the time to write such a detailed and helpful reply. I really appreciate it!

    I checked the quarantined file again. Interestingly, F-Secure displays a "Hash:" field, but it is completely empty, so unfortunately I cannot retrieve the SHA-256 hash from quarantine.

    The executable was created when uv set up a Python 3.11.17 virtual environment. I've since investigated the installation quite thoroughly, including verifying the original Python distribution against official checksums. Everything checked so far suggests a false positive, although I would still like F-Secure to confirm this.

    Your suggestion to submit a screenshot instead of the actual quarantined file is very helpful. I'll give that a try.

    I'll also try your suggestion of using Microsoft Edge in InPrivate mode to reach a human support agent. I hadn't thought of that!

    I would prefer to resolve this properly rather than restore the executable or add an antivirus exclusion.

    Thanks again for your time. It's genuinely appreciated!

    Best regards

    Peter

    2Like Awesome

Categories