Hi David,
Recently, Microsoft denied the inclusion of Remote Utilities in the MS Store, even though the previous version was accepted without any problems (both Viewer and Host). In their message, they referred to VirusTotal results as the basis for their decision. Apparently, if there is even a 1/70 detection ratio, they reject the submission—regardless of whether it’s a false positive or a warning like "potentially unwanted."
Even after ESET, whose PUP detection it was, directly confirmed via email that it wasn’t a malware detection, Microsoft didn’t revise their decision.
While we can't confirm this with absolute certainty, there are indications that Microsoft Defender and SmartScreen may rely on third-party detection data—such as VirusTotal results or sandbox analysis—to form their verdicts. This is concerning because VirusTotal was never intended for such purposes. It's an experimental platform, and its engines often operate in their most aggressive detection modes.
We always encourage users to immediately file a complaint with Microsoft whenever there’s even a single file detection or SmartScreen blocks a file download in Edge (as is currently the case with Agent). Edge provides a dedicated menu option for submitting such complaints. Without these complaints any antivirus detection system tends to retain false positive classifications unless explicitly brought to their attention.
Currently, our software adheres to
every single CSA guideline—any analyst can easily verify this by examining the software. In our upcoming release, we will introduce features that could further address this situation. However, it seems that many antivirus engines disregard performing any thorough analysis.
It might be considered unethical to point this out, but I feel it’s important to mention. After the production systems(!) of one of our competitors—well-known remote access software—were breached a year ago and their digital signature was compromised, it took nearly a week for
some antivirus software to start blocking files signed with that signature. During that time, it was unclear how many malware builds might have been signed with it and distributed.
Now compare this to every version of Remote Utilities being blocked by some well-known a/v programs immediately after release, despite being signed with a digital signature that has never been compromised, only for the detections to be removed later with apologies. 🤦
