False posetive - cant say ok for the file - how can I do that?

Nmouse

God a false posetive, file is 1,4G byte, EXE file from https://bartender.com/

Its there great program, but watever i do, i cant open/install the file.

How can I mark this file as ok.

//Regards.

Kamil

Hi @Nmouse,

Thanks for sharing the log. Looking at it, this isn't a classic AV false positive where the file gets quarantined. The EXE from bartender.com is actually being allowed to run by Application Control (you can see it's logged under the "Default allow and monitor rule," which means it's permitted but tracked).

The actual blocker is DataGuard. The log shows:

DataGuard has blocked an attempt to access "MediaHandling.xml"

DataGuard protects specific folders and files from being modified by untrusted applications. During installation, BarTender is trying to write to or modify MediaHandling.xml, and DataGuard is preventing that.

To resolve this, your administrator needs to add the BarTender installer (and ideally the BarTender application itself) as a trusted/allowed application in the DataGuard policy in Elements Security Center. The steps are:

1. Go to Elements Security Center > Profiles > select the profile applied to this device
2. Navigate to the DataGuard settings
3. Under the monitored folder or vault that covers the location of MediaHandling.xml, add the BarTender installer executable as a trusted application
4. Save and push the policy to the device, then retry the installation

If you're not sure which folder is being protected, your admin can check the DataGuard configuration to see which paths are covered.

This is not a sample submission case since the file isn't being detected as malicious. It's a DataGuard access control issue that needs a policy adjustment on your end.