Visual Studio 14 : Too Many False Positives To Attach/report

I have submitted a few sample files via the "false positive" automated system, but I have too many to submit. Here is a somewhat lengthy list - all of them related to a seemingly legitimate Visual Studio 14 install (hash verified with Microsoft before installation, although I do realize that malware can infect after the fact).

File Name Infection Action
C:\Program Files (x86)\Microsoft Web Tools\Packages\Microsoft.Net.Compilers.1.0.0\tools\Microsoft.CodeAnalysis.CSharp.dll Gen:Heur.MSIL.Krypt.2 Moved to Quarantine
C:\Program Files (x86)\Microsoft Web Tools\Packages\Microsoft.Net.Compilers.1.0.0\tools\System.Reflection.Metadata.dll Gen:Heur.MSIL.Krypt.2 Moved to Quarantine
C:\Program Files (x86)\Microsoft Web Tools\Packages\Microsoft.Net.Compilers.1.0.0\tools\Microsoft.CodeAnalysis.VisualBasic.dll Gen:Heur.MSIL.Krypt.2 Moved to Quarantine
C:\Program Files (x86)\Microsoft Web Tools\Packages\Microsoft.Net.Compilers.1.0.0\tools\Microsoft.CodeAnalysis.dll Gen:Heur.MSIL.Krypt.2 Moved to Quarantine
C:\Program Files (x86)\Microsoft Web Tools\Packages\Microsoft.Net.Compilers.1.0.0\tools\VBCSCompiler.exe Gen:Heur.MSIL.Krypt.2 Moved to Quarantine
C:\Program Files (x86)\Microsoft Web Tools\DNX\dnx-clr-win-x64.1.0.0-beta8\bin\Microsoft.CodeAnalysis.CSharp.dll Gen:Heur.MSIL.Krypt.2 Moved to Quarantine
C:\Program Files (x86)\Microsoft Web Tools\DNX\dnx-clr-win-x64.1.0.0-beta8\bin\Microsoft.CodeAnalysis.dll Gen:Heur.MSIL.Krypt.2 Moved to Quarantine
C:\Program Files (x86)\Microsoft Web Tools\DNX\dnx-clr-win-x86.1.0.0-beta8\bin\Microsoft.CodeAnalysis.dll Gen:Heur.MSIL.Krypt.2 Moved to Quarantine
C:\Program Files (x86)\Microsoft Web Tools\DNX\dnx-clr-win-x86.1.0.0-beta8\bin\Microsoft.CodeAnalysis.CSharp.dll Gen:Heur.MSIL.Krypt.2 Moved to Quarantine
C:\Program Files (x86)\Microsoft Web Tools\DNX\dnx-coreclr-win-x64.1.0.0-beta8\bin\Microsoft.CodeAnalysis.dll Gen:Heur.MSIL.Krypt.2 Moved to Quarantine
C:\Program Files (x86)\Microsoft Web Tools\DNX\dnx-coreclr-win-x64.1.0.0-beta8\bin\Microsoft.CodeAnalysis.CSharp.dll Gen:Heur.MSIL.Krypt.2 Moved to Quarantine
C:\Program Files (x86)\Microsoft Web Tools\DNX\dnx-coreclr-win-x86.1.0.0-beta8\bin\Microsoft.CodeAnalysis.dll Gen:Heur.MSIL.Krypt.2 Moved to Quarantine
C:\Program Files (x86)\Microsoft Web Tools\DNX\dnx-coreclr-win-x86.1.0.0-beta8\bin\Microsoft.CodeAnalysis.CSharp.dll Gen:Heur.MSIL.Krypt.2 Moved to Quarantine
C:\Program Files (x86)\MSBuild\14.0\Bin\Microsoft.CodeAnalysis.CSharp.dll Gen:Heur.MSIL.Krypt.2 Moved to Quarantine
C:\Program Files (x86)\MSBuild\14.0\Bin\Microsoft.CodeAnalysis.dll Gen:Heur.MSIL.Krypt.2 Moved to Quarantine
C:\Program Files (x86)\MSBuild\14.0\Bin\Microsoft.CodeAnalysis.VisualBasic.dll Gen:Heur.MSIL.Krypt.2 Moved to Quarantine
C:\Program Files (x86)\MSBuild\14.0\Bin\Microsoft.CodeAnalysis.Scripting.dll Gen:Heur.MSIL.Krypt.2 Moved to Quarantine
C:\Program Files (x86)\MSBuild\14.0\Bin\Microsoft.Build.Tasks.CodeAnalysis.dll Gen:Heur.MSIL.Krypt.2 Moved to Quarantine
C:\Program Files (x86)\MSBuild\14.0\Bin\csc.exe Gen:Heur.MSIL.Krypt.2 Moved to Quarantine
C:\Program Files (x86)\MSBuild\14.0\Bin\VBCSCompiler.exe Gen:Heur.MSIL.Krypt.2 Moved to Quarantine
C:\Program Files (x86)\MSBuild\14.0\Bin\vbc.exe Gen:Heur.MSIL.Krypt.2 Moved to Quarantine
C:\Program Files (x86)\Microsoft ASP.NET\ASP.NET Web Stack 5\Packages\Microsoft.Net.Compilers.1.0.0\tools\VBCSCompiler.exe Gen:Heur.MSIL.Krypt.2 Moved to Quarantine
C:\Program Files (x86)\MSBuild\14.0\Bin\amd64\Microsoft.CodeAnalysis.CSharp.dll Gen:Heur.MSIL.Krypt.2 Moved to Quarantine
C:\Program Files (x86)\MSBuild\14.0\Bin\amd64\Microsoft.CodeAnalysis.dll Gen:Heur.MSIL.Krypt.2 Moved to Quarantine
C:\Program Files (x86)\MSBuild\14.0\Bin\amd64\Microsoft.Build.Tasks.CodeAnalysis.dll Gen:Heur.MSIL.Krypt.2 Moved to Quarantine
C:\Program Files (x86)\MSBuild\14.0\Bin\amd64\Microsoft.CodeAnalysis.Scripting.dll Gen:Heur.MSIL.Krypt.2 Moved to Quarantine
C:\Program Files (x86)\MSBuild\14.0\Bin\amd64\Microsoft.CodeAnalysis.VisualBasic.dll Gen:Heur.MSIL.Krypt.2 Moved to Quarantine
C:\Program Files (x86)\MSBuild\14.0\Bin\amd64\VBCSCompiler.exe Gen:Heur.MSIL.Krypt.2 Moved to Quarantine
C:\Program Files (x86)\MSBuild\14.0\Bin\amd64\csc.exe Gen:Heur.MSIL.Krypt.2 Moved to Quarantine
C:\Program Files (x86)\MSBuild\14.0\Bin\amd64\vbc.exe Gen:Heur.MSIL.Krypt.2 Moved to Quarantine
C:\Program Files (x86)\Microsoft Visual Studio 14.0\Common7\IDE\PrivateAssemblies\Microsoft.CodeAnalysis.VisualBasic.Features.dll Gen:Heur.MSIL.Krypt.2 Moved to Quarantine
C:\Program Files (x86)\Microsoft Visual Studio 14.0\Common7\IDE\PrivateAssemblies\Microsoft.CodeAnalysis.Workspaces.Desktop.dll Gen:Heur.MSIL.Krypt.2 Moved to Quarantine
C:\Program Files (x86)\Microsoft Visual Studio 14.0\Common7\IDE\PrivateAssemblies\Microsoft.CodeAnalysis.EditorFeatures.dll Gen:Heur.MSIL.Krypt.2 Moved to Quarantine
C:\Program Files (x86)\Microsoft Visual Studio 14.0\Common7\IDE\PrivateAssemblies\Microsoft.CodeAnalysis.CSharp.Workspaces.dll Gen:Heur.MSIL.Krypt.2 Moved to Quarantine
C:\Program Files (x86)\Microsoft Visual Studio 14.0\Common7\IDE\PrivateAssemblies\Microsoft.CodeAnalysis.CSharp.Features.dll Gen:Heur.MSIL.Krypt.2 Moved to Quarantine
C:\Program Files (x86)\Microsoft Visual Studio 14.0\Common7\IDE\PrivateAssemblies\Microsoft.CodeAnalysis.dll Gen:Heur.MSIL.Krypt.2 Moved to Quarantine
C:\Program Files (x86)\Microsoft Visual Studio 14.0\Common7\IDE\PrivateAssemblies\Microsoft.CodeAnalysis.Workspaces.dll Gen:Heur.MSIL.Krypt.2 Moved to Quarantine
C:\Program Files (x86)\Microsoft Visual Studio 14.0\Common7\IDE\PrivateAssemblies\Microsoft.CodeAnalysis.Features.dll Gen:Heur.MSIL.Krypt.2 Moved to Quarantine
C:\Program Files (x86)\Microsoft Visual Studio 14.0\Common7\IDE\PrivateAssemblies\Microsoft.CodeAnalysis.Scripting.dll Gen:Heur.MSIL.Krypt.2 Moved to Quarantine
C:\Program Files (x86)\Microsoft Visual Studio 14.0\Common7\IDE\PrivateAssemblies\Microsoft.CodeAnalysis.CSharp.dll Gen:Heur.MSIL.Krypt.2 Moved to Quarantine
C:\Program Files (x86)\Microsoft Visual Studio 14.0\Common7\IDE\PrivateAssemblies\Microsoft.VisualStudio.LanguageServices.dll Gen:Heur.MSIL.Krypt.2 Moved to Quarantine
C:\Program Files (x86)\Microsoft Visual Studio 14.0\Common7\IDE\PrivateAssemblies\Microsoft.CodeAnalysis.VisualBasic.dll Gen:Heur.MSIL.Krypt.2 Moved to Quarantine

Edit: Suppose I should actually ask a question... anyone else see this? What is the best way to batch upload these files for analysis?

Find more posts tagged with

false positive

visual studio

Comments

JulianMadle

Just installed Bitdefender free version and got exactly the same; bit of a problem as I am a .NET developer. Are these false positives?

csalgau

Hello,
There was a brief moment around the time the original posted reported this when we did have a false positive on some files related to a specific Visual Studio version. This was solved quite fast and you should no longer be seeing this.
Please provide the exact Visual Studio version and, if possible, your Bitdefender signature version at this time.
To check that the problem is not on your computer only, try uploading a couple of blocked files to Virus Total or a similar service and provide some links. The main concern for me is seeing file hashes, so if you can do this yourself, you could also just provide some file hashes for detected binaries.
You may need to temporarily disable real-time protection or add the files to exceptions in order to upload.

Thank you.

JulianMadle

OK have just seen same result on second machine; am pretty new to this but have submitted one file that Bitdefender reported to Virus Total and it reported it as "probably harmless":

https://virustotal.com/en/file/2de70be069a0b65c5322b79c255d45c6b8beaad871aff96137c2e2b6f7213a98/analysis/1474982780/

Most of the files were located in "C:\Program Files (x86)\MSBuild\14.0" and "C:\Program Files (x86)\Microsoft Visual Studio 14.0\Common7\IDE\PrivateAssemblies"; am currently using Visual Studio 2015 (v14.0.25422.01 update 3) but have had other versions previously installed. This was a first install of Bitdefender on the computer today, not sure of signature as it updated just after the initial scan completed.

Sorry not sure how to make file hashes. Hope that helps.

Danielst

Hi Julian,

We have opened case number 2016100316440001 in order to investigate the False-Positive case. You should find an e-mail from us in your Inbox(also check the Spam folder) with a way of sending us some of the detected samples.

Thank you,

timemrah

Scan Results

The Virus Shield detected 43 infected items.

Scan Results

File Name   Infection   Action

C:\Program Files (x86)\Microsoft Visual Studio 14.0\Common7\IDE\PrivateAssemblies\Microsoft.CodeAnalysis.CSharp.dll   Gen:Heur.MSIL.Krypt.2   Moved to Quarantine

C:\Program Files (x86)\Microsoft Visual Studio 14.0\Common7\IDE\PrivateAssemblies\Microsoft.CodeAnalysis.CSharp.Features.dll   Gen:Heur.MSIL.Krypt.2   Moved to Quarantine

C:\Program Files (x86)\Microsoft Visual Studio 14.0\Common7\IDE\PrivateAssemblies\Microsoft.CodeAnalysis.CSharp.Workspaces.dll   Gen:Heur.MSIL.Krypt.2   Moved to Quarantine

C:\Program Files (x86)\Microsoft Visual Studio 14.0\Common7\IDE\PrivateAssemblies\Microsoft.VisualStudio.LanguageServices.dll   Gen:Heur.MSIL.Krypt.2   Moved to Quarantine

C:\Program Files (x86)\Microsoft Visual Studio 14.0\Common7\IDE\PrivateAssemblies\Microsoft.CodeAnalysis.Workspaces.Desktop.dll   Gen:Heur.MSIL.Krypt.2   Moved to Quarantine

C:\Program Files (x86)\Microsoft Visual Studio 14.0\Common7\IDE\PrivateAssemblies\Microsoft.CodeAnalysis.VisualBasic.Features.dll   Gen:Heur.MSIL.Krypt.2   Moved to Quarantine

C:\Program Files (x86)\Microsoft Visual Studio 14.0\Common7\IDE\PrivateAssemblies\Microsoft.CodeAnalysis.EditorFeatures.dll   Gen:Heur.MSIL.Krypt.2   Moved to Quarantine

C:\Program Files (x86)\Microsoft Visual Studio 14.0\Common7\IDE\PrivateAssemblies\Microsoft.CodeAnalysis.Features.dll   Gen:Heur.MSIL.Krypt.2   Moved to Quarantine

C:\Program Files (x86)\Microsoft Visual Studio 14.0\Common7\IDE\PrivateAssemblies\Microsoft.CodeAnalysis.dll   Gen:Heur.MSIL.Krypt.2   Moved to Quarantine

C:\Program Files (x86)\Microsoft Visual Studio 14.0\Common7\IDE\PrivateAssemblies\Microsoft.CodeAnalysis.Scripting.dll   Gen:Heur.MSIL.Krypt.2   Moved to Quarantine

C:\Program Files (x86)\Microsoft Visual Studio 14.0\Common7\IDE\PrivateAssemblies\Microsoft.CodeAnalysis.VisualBasic.dll   Gen:Heur.MSIL.Krypt.2   Moved to Quarantine

C:\Program Files (x86)\Microsoft Web Tools\Packages\Microsoft.Net.Compilers.1.0.0\tools\Microsoft.CodeAnalysis.dll   Gen:Heur.MSIL.Krypt.2   Moved to Quarantine

C:\Program Files (x86)\Microsoft Visual Studio 14.0\Common7\IDE\PrivateAssemblies\Microsoft.CodeAnalysis.Workspaces.dll   Gen:Heur.MSIL.Krypt.2   Moved to Quarantine

C:\Program Files (x86)\Microsoft Web Tools\Packages\Microsoft.Net.Compilers.1.0.0\tools\Microsoft.CodeAnalysis.VisualBasic.dll   Gen:Heur.MSIL.Krypt.2   Moved to Quarantine

C:\Program Files (x86)\Microsoft Web Tools\Packages\Microsoft.Net.Compilers.1.0.0\tools\System.Reflection.Metadata.dll   Gen:Heur.MSIL.Krypt.2   Moved to Quarantine

C:\Program Files (x86)\Microsoft Web Tools\Packages\Microsoft.Net.Compilers.1.0.0\tools\VBCSCompiler.exe   Gen:Heur.MSIL.Krypt.2   Moved to Quarantine

C:\Program Files (x86)\Microsoft Web Tools\Packages\Microsoft.Net.Compilers.1.0.0\tools\Microsoft.CodeAnalysis.CSharp.dll   Gen:Heur.MSIL.Krypt.2   Moved to Quarantine

C:\Program Files (x86)\Microsoft Web Tools\DNX\dnx-clr-win-x64.1.0.0-beta8\bin\Microsoft.CodeAnalysis.dll   Gen:Heur.MSIL.Krypt.2   Moved to Quarantine

C:\Program Files (x86)\Microsoft Web Tools\DNX\dnx-clr-win-x86.1.0.0-beta8\bin\Microsoft.CodeAnalysis.CSharp.dll   Gen:Heur.MSIL.Krypt.2   Moved to Quarantine

C:\Program Files (x86)\Microsoft Web Tools\DNX\dnx-clr-win-x86.1.0.0-beta8\bin\Microsoft.CodeAnalysis.dll   Gen:Heur.MSIL.Krypt.2   Moved to Quarantine

C:\Program Files (x86)\Microsoft Web Tools\DNX\dnx-clr-win-x64.1.0.0-beta8\bin\Microsoft.CodeAnalysis.CSharp.dll   Gen:Heur.MSIL.Krypt.2   Moved to Quarantine

C:\Program Files (x86)\Microsoft Web Tools\DNX\dnx-coreclr-win-x64.1.0.0-beta8\bin\Microsoft.CodeAnalysis.dll   Gen:Heur.MSIL.Krypt.2   Moved to Quarantine

C:\Program Files (x86)\Microsoft Web Tools\DNX\dnx-coreclr-win-x64.1.0.0-beta8\bin\Microsoft.CodeAnalysis.CSharp.dll   Gen:Heur.MSIL.Krypt.2   Moved to Quarantine

C:\Program Files (x86)\Microsoft Web Tools\DNX\dnx-coreclr-win-x86.1.0.0-beta8\bin\Microsoft.CodeAnalysis.dll   Gen:Heur.MSIL.Krypt.2   Moved to Quarantine

C:\Program Files (x86)\Microsoft Web Tools\DNX\dnx-coreclr-win-x86.1.0.0-beta8\bin\Microsoft.CodeAnalysis.CSharp.dll   Gen:Heur.MSIL.Krypt.2   Moved to Quarantine

C:\Program Files (x86)\MSBuild\14.0\Bin\csc.exe   Gen:Heur.MSIL.Krypt.2   Moved to Quarantine

C:\Program Files (x86)\MSBuild\14.0\Bin\vbc.exe   Gen:Heur.MSIL.Krypt.2   Moved to Quarantine

C:\Program Files (x86)\MSBuild\14.0\Bin\Microsoft.CodeAnalysis.dll   Gen:Heur.MSIL.Krypt.2   Moved to Quarantine

C:\Program Files (x86)\MSBuild\14.0\Bin\Microsoft.Build.Tasks.CodeAnalysis.dll   Gen:Heur.MSIL.Krypt.2   Moved to Quarantine

C:\Program Files (x86)\MSBuild\14.0\Bin\Microsoft.CodeAnalysis.Scripting.dll   Gen:Heur.MSIL.Krypt.2   Moved to Quarantine

C:\Program Files (x86)\MSBuild\14.0\Bin\Microsoft.CodeAnalysis.CSharp.dll   Gen:Heur.MSIL.Krypt.2   Moved to Quarantine

C:\Program Files (x86)\MSBuild\14.0\Bin\Microsoft.CodeAnalysis.VisualBasic.dll   Gen:Heur.MSIL.Krypt.2   Moved to Quarantine

C:\Program Files (x86)\MSBuild\14.0\Bin\VBCSCompiler.exe   Gen:Heur.MSIL.Krypt.2   Moved to Quarantine

C:\Program Files (x86)\Microsoft ASP.NET\ASP.NET Web Stack 5\Packages\Microsoft.Net.Compilers.1.0.0\tools\VBCSCompiler.exe   Gen:Heur.MSIL.Krypt.2   Moved to Quarantine

C:\Program Files (x86)\MSBuild\14.0\Bin\amd64\Microsoft.Build.Tasks.CodeAnalysis.dll   Gen:Heur.MSIL.Krypt.2   Moved to Quarantine

C:\Program Files (x86)\MSBuild\14.0\Bin\amd64\Microsoft.CodeAnalysis.dll   Gen:Heur.MSIL.Krypt.2   Moved to Quarantine

C:\Program Files (x86)\MSBuild\14.0\Bin\amd64\Microsoft.CodeAnalysis.Scripting.dll   Gen:Heur.MSIL.Krypt.2   Moved to Quarantine

C:\Program Files (x86)\MSBuild\14.0\Bin\amd64\Microsoft.CodeAnalysis.CSharp.dll   Gen:Heur.MSIL.Krypt.2   Moved to Quarantine

C:\Program Files (x86)\MSBuild\14.0\Bin\amd64\csc.exe   Gen:Heur.MSIL.Krypt.2   Moved to Quarantine

C:\Program Files (x86)\MSBuild\14.0\Bin\amd64\Microsoft.CodeAnalysis.VisualBasic.dll   Gen:Heur.MSIL.Krypt.2   Moved to Quarantine

C:\Program Files (x86)\MSBuild\14.0\Bin\amd64\vbc.exe   Gen:Heur.MSIL.Krypt.2   Moved to Quarantine

C:\Program Files (x86)\MSBuild\14.0\Bin\amd64\VBCSCompiler.exe   Gen:Heur.MSIL.Krypt.2   Moved to Quarantine

C:\Program Files (x86)\Microsoft Office\root\Office16\DCF\filecompare.exe   Gen:Trojan.Heur2.FU.py2@aO8IOZhi   Moved to Quarantine

What is this?

smit293

I just installed BitDefender Free today and also got similar messages like these:

Scan Results

The Virus Shield detected 9 infected items.

Scan Results

File Name   Infection   Action

C:\Program Files (x86)\Microsoft Web Tools\Packages\Microsoft.Net.Compilers.1.0.0\tools\Microsoft.CodeAnalysis.CSharp.dll   Gen:Heur.MSIL.Krypt.2   Moved to Quarantine

C:\Program Files (x86)\Microsoft Web Tools\Packages\Microsoft.Net.Compilers.1.0.0\tools\Microsoft.CodeAnalysis.VisualBasic.dll   Gen:Heur.MSIL.Krypt.2   Moved to Quarantine

C:\Program Files (x86)\Microsoft Web Tools\Packages\Microsoft.Net.Compilers.1.0.0\tools\Microsoft.CodeAnalysis.dll   Gen:Heur.MSIL.Krypt.2   Moved to Quarantine

C:\Program Files (x86)\Microsoft Web Tools\Packages\Microsoft.Net.Compilers.1.0.0\tools\VBCSCompiler.exe   Gen:Heur.MSIL.Krypt.2   Moved to Quarantine

C:\Program Files (x86)\Microsoft Web Tools\Packages\Microsoft.Net.Compilers.1.0.0\tools\System.Reflection.Metadata.dll   Gen:Heur.MSIL.Krypt.2   Moved to Quarantine

C:\Program Files (x86)\Microsoft Web Tools\DNX\dnx-clr-win-x86.1.0.0-beta8\bin\Microsoft.CodeAnalysis.dll   Gen:Heur.MSIL.Krypt.2   Moved to Quarantine

C:\Program Files (x86)\Microsoft Web Tools\DNX\dnx-clr-win-x86.1.0.0-beta8\bin\Microsoft.CodeAnalysis.CSharp.dll   Gen:Heur.MSIL.Krypt.2   Moved to Quarantine

C:\Program Files (x86)\Microsoft Web Tools\DNX\dnx-clr-win-x64.1.0.0-beta8\bin\Microsoft.CodeAnalysis.CSharp.dll   Gen:Heur.MSIL.Krypt.2   Moved to Quarantine

C:\Program Files (x86)\Microsoft Web Tools\DNX\dnx-clr-win-x64.1.0.0-beta8\bin\Microsoft.CodeAnalysis.dll   Gen:Heur.MSIL.Krypt.2   Moved to Quarantine

Curious if this is going to be an ongoing problem as a Developer? Thanks for any input.

toddhd

I just installed BitDefender free today and I am having the exact same problem, same files, same false positives.

Danielst

Hi Toddhd,

If you are still encountering an issue with the detection of those files, temporarily disable the protection and copy all of the files into a folder. After that, archive the folder and attach it to an e-mail at bitsy@bitdefender.com so we may investigate them.

Also, please create and send us a support tool log from the computer. You can create a support tool log as in the article below:

http://www.bitdefender.com/support/-1168.html

Thank you,