False Positive

[3nigma]

Ok, my virus definitions have just been updated about 30mins ago and one of my programs has been quarantined by Eset. I have used this program for months, i am 100% positive it's not a virus Eset claims it to be.

The program in question is called Universal Extractor.

http://www.portablefreeware.com/?id=641

Can anyone inform Eset of this mistake and send out new virus definitions as soon as possible. This isnt the first time this has happened, a while back Eset started sending all the uninstallers of Innosetup files to quarantine. Thankfully, it wasnt set to delete them.

[agoretsky]

Hello,

The download seems to be unavailable right now.

What was the exact threat detected by ESET's software and which version of ESET's virus signature are you using?

Knowing that will help ESET investigate the issue.

You can also send a copy of the file to ESET at samples@eset.sk inside a .ZIP or .RAR file protected with a password of "infected", a Subject: of "possible false positive" and a link to this message thread for examination by ESET's virus lab.

Regards,

Aryeh Goretsky

[proactivelover]

i email eset about this FP
link for Universal Extractor v1.6
http://www.filehippo.com/download_universal_extractor/

[3nigma]

Thanks for the quick response. This is the name of the threat that Eset detects
when i attempt to use Universal Extractor.

Win32/Sohanad.NCB worm

Version of Virus Signature Database. 3893 (20090226)

You can also send a copy of the file to ESET at samples@eset.sk inside a .ZIP or .RAR file protected with a password of "infected", a Subject: of "possible false positive" and a link to this message thread for examination by ESET's virus lab.

Ah,, thank you. I'll send them an email as soon as possible. Thanks for your assistance.

[proactivelover]

3894 fixes this FP

[3nigma]

Yep, i restored the file from quarantine and scanned it with Eset. New definitions dont recognise it as a virus.

I have another False Positive to report. I use this program from time to time. Until yesterday i had it zipped on my external HDD, then when i unpacked it. Eset flagged it as a virus.

http://labs.idefense.com/software/malcode.php

probably unknown NewHeur_PE virus

3895 (20090227)

[funkydude]

http://kb.eset.com/esetkb/index?page=content&id=SOLN141

[3nigma]

Well, i sent them an email + Sample yesterday. No update as of yet unfortunately. Has anyone else downloaded this file and got the same result.