False positive in Kaspersky

[LucasFarinha92]

Kaspersky recognizes my agent, both the EXE and the service, as a virus. I've already updated my agent to the latest version, including its digital signature, but nothing. All agents I create from groups are recognized as viruses.

This is complicated because it requires me to go to the machines locally, mark the exclusion hash, and the installation folder.

Has anyone else had problems with false positives?

[si458]

everyone has had problems with false positives
its because bad actors have abused the meshagent software and meshcentral
so now most AVs just detect it as a HACKTOOL and delete/remove it
no way around it sadly apart from add to allow list
OR build the meshagent yourself from scratch from the repo https://github.com/Ylianst/MeshAgent
and then replace every single mension of the word MeshAgent and build and hope it doesnt get detected!

[LucasFarinha92]

Thank you. I think in my case, creating from scratch would be interesting, at least to change the agent's name. I appreciate the quick feedback.

[si458]

you can already customise the meshagent including filename etc and where its installed
https://ylianst.github.io/MeshCentral/meshcentral/customization/#agent-branding
agentCustomization handles things like what company is called, filename, etc
agentFileInfo handles the meta data of the file like copyright, description, icon, etc

you just add them to your config.json, restart meshcentral, wait a minute, then download a new copy of the agent from the web ui

any old installed agents WONT AUTOUPDATE/CUSTOMISE, so you must install a fresh

this is how i moved from meshagent to myremoteagent
i customised it afterwards, then installed the new agent on the remote pc (as its called something totally different)
then uninstalled the old meshagent

[PathfinderNetworks]

The key to getting around this issue is to customize the agent as si458 mentioned. But that alone won't do it. The primary step that needs to be done is to buy a code signing certificate and sign the agent with that code signing certificate.