Sure Sense marks some Gimp installation files as malware while Virus Total sees no problem

[la-marc]

I was trying to install GIMP (conecretely: gimp-2.10.30-setup.exe) on an HP laptop with Win 10 Pro (build 19043). I have checked the hash of the install file. HP Sure Sense warns of a malicious tmp file during the installation. The hash of the quarantined file is: af915bbb2ecc2e26cc028c09b5d3ff4e7379ac82c2eaf1fe6ce944a8c3a096f0

I have checked both the installation file and the quarantined file with the (online) Virus Total and it marks them as clean.

Could this be a false positive?

[itsmyname]

@la-marc -- Could this be a false positive?

I would go further, and say "definitely", given the report from VirusTotal.

Wait a few hours, while VirusTotal updates each of the anti-virus products, to see if the detection changes.

Force an update of your computer's anti-virus software.

You might want to temporarily disable "real-time" detection in your anti-virus software, install GIMP, and then re-enable "real-time" detection BEFORE you invoke GIMP. Then virus-scan that "temp" folder -- GIMP may have deleted the file, as the final step when it was installing GIMP. Virus-scan the folder containing the GIMP software.

[la-marc]

I see. Thanks for your reply. I will follow the suggestion. However, I asked the same question on GIMP's GitLab and they suggested that one can often send a suspected false positive to the anti-virus' support for further inspection. Is it possible with HP Sure Sense? I have not seen any way of contacting people behind Sure Sense directly.

[itsmyname · Accepted solution]

@la-marc -- they suggested that one can often send a suspected false positive to the anti-virus' support for further inspection.

To me, that seems to be a very-good suggestion.

Is it possible with HP Sure Sense?

I would hope that it is possible.

I have not seen any way of directly contacting people behind Sure Sense.

Since it is a HP product, you could try contacting HP Support, and asking them how you can contact HP Sure Sense.

[content removed]

[la-marc]

I am slightly confused by your examples of "I have not seen..." (is this some language subtlety I'm missing or do you mean that the fact I haven't seen something doesn't mean it doesn't exist?), but thanks for the reply!

[Dragon-Fur]

@la-marc 

Apologies for jumping in unannounced.

At least on the system where I have this running, Sure Sense is now part of Wolf Security.

Is your system running the newer type of the app?

Search for the Wolf Security application in the Windows Start menu.

If you have checked the appropriate box in Wolf Security > Settings > Configuration, HP collects threat and diagnostic data. 

No need to send a separate message "this happened to me". 

I would guess that the older Sure Sense application still has a similar setting (see example - "Customer Experience Improvement").

Similar to the original Sure Sense, Wolf Security > Settings > Exclusions allows you to assign "exclusions" to prevent over zealous security from preventing installation or updates of "known to be good" software.

Below is an example from an older version of Sure Sense that illustrates adding an exclusion to allow the Edge Browser to update.  Example created March 2021.  Sure Sense and Wolf Security both support the Exclusions option.

Sure_Sense_Wolf_Security_Settings_1

Thank you for participating in the HP Community.

Our Community is comprised of volunteers - people who own and use HP devices.