# Cisco AMP Flags Malware

**URL:** https://community.mp3tag.de/t/cisco-amp-flags-malware/53311
**Category:** General Discussion
**Created:** [May 23, 2021, 6:56am UTC](https://community.mp3tag.de/t/cisco-amp-flags-malware/53311 "2021-05-23T06:56:10Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![moxy](https://community.mp3tag.de/letter_avatar_proxy/v4/letter/m/35a633/32.png) [@moxy](https://community.mp3tag.de/u/moxy)
#### Post date: [May 23, 2021, 6:56am UTC](https://community.mp3tag.de/t/cisco-amp-flags-malware/53311/1 "2021-05-23T06:56:10Z")

</div>

Long time mp3tag lover here, first time poster. After years and years of mp3tag use, I just wanted to bring to your attention that Cisco AMP flagged mp3tag as malware as of yesterday afternoon. I've flagged it as safe, but AMP has a few features where it'll upload files to global databases for analysis and I'd hate for you to start getting this showing up elsewhere.

 ![mp3tag_AMP](https://community.mp3tag.de/uploads/default/original/2X/8/8af1237626e2c4efb99888302ca0ebeb21dd26db.png)

---

<div class="post-metadata">

### Author: ![Florian](https://community.mp3tag.de/user_avatar/community.mp3tag.de/florian/32/5759_2.png) [@Florian](https://community.mp3tag.de/u/Florian)
#### Post date: [May 23, 2021, 7:07am UTC](https://community.mp3tag.de/t/cisco-amp-flags-malware/53311/2 "2021-05-23T07:07:21Z")

</div>

Thanks for the feedback! Probably a false positive — I've just scanned via [VirusTotal](https://www.virustotal.com/gui/file/d00a038a7e79a67116907748c8fec877f54348007766dd52b3522fdc7afbd949/detection) and all 68 engines say it's clean.

---

<div class="post-metadata">

### Author: ![moxy](https://community.mp3tag.de/letter_avatar_proxy/v4/letter/m/35a633/32.png) [@moxy](https://community.mp3tag.de/u/moxy)
#### Post date: [May 23, 2021, 7:08am UTC](https://community.mp3tag.de/t/cisco-amp-flags-malware/53311/3 "2021-05-23T07:08:58Z")

</div>

Yup, understood. I think the analysis engine just sees mp3tag.exe rewriting a number of files and associates it with the same behavior ransomware would exhibit. It stands to reason and I understand it isn't any cause for concern. Thanks for the feedback.

---

<div class="post-metadata">

### Author: ![system](https://community.mp3tag.de/uploads/default/original/2X/c/ce7035d426cb755a7916793326d23b465222a407.png) [@system](https://community.mp3tag.de/u/system)
#### Post date: [June 22, 2021, 7:09am UTC](https://community.mp3tag.de/t/cisco-amp-flags-malware/53311/4 "2021-06-22T07:09:43Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.