Hello all, I recently upgraded to 4.22.1 and later found an alert from Webroot stating the manifest tool had been identified as Pua.Gen. I’m certain this is a false positive, but just wanted to bring this to the attention of the developers. Thanks, Mark

Hi Mark, Yes, it is a false positive. In order to support bitlocker with automated ingest I had to make changes to the program and recompile it. If there are anymore questions please let me know. Mark

Hey Mark! I figured as much. I have let Webroot know, as well, so they can mark it as such on the backend. Thanks for all of your hard work! Mark NOTICE: This email may contain confidential (including but not limited to) HIPAA-protected and/or privileged information intended only for specific, pr…

Sorry this took so long to reply to. Been busy with work (IT life!). Webroot has whitelisted on their backend now. [image]

Webroot AV: Autopsy 4.22.1 MANIFESTTOOL.EXE identifed as Pua.Gen (False positive?)

Autopsy Help

Mark_McKinnon May 26, 2025, 5:10pm 5

Thank You for doing it.

Topic		Replies	Views
virus infections software Autopsy Autopsy Help	0	453	April 19, 2021
Autopsy 4.22.1 SIGSEGV attempting to ingest bitlocker image Autopsy Help	1	89	June 6, 2025
New artifacts not displayed Autopsy Development	25	2218	October 6, 2021
Error in AUTOPSY 4.14 64 bit Autopsy Help	22	4157	February 17, 2020
Autopsy 4.23.0 start always in Developer mode Autopsy Help	1	51	May 7, 2026

Webroot AV: Autopsy 4.22.1 MANIFESTTOOL.EXE identifed as Pua.Gen (False positive?)

Related topics