false positive?

Discussion in 'ESET NOD32 Antivirus' started by stabako, Feb 18, 2009.

Thread Status:
Not open for further replies.
  1. stabako

    stabako Registered Member

    Nov 27, 2006
    Hello, I have a user who is getting a "connection terminated" message when using the website "Probably a variant of BAT/DelTree trojan".

    I have checked this website using IE7 and Firefox 3 and received the same message intermittently- sometimes it works fine.

    His PC XPP SP3 mine is Vista Ult. SP1. ESET NOD32 Business Edition v3.0.650 on his and v3.0.669 on mine, both with latest defs (3865 as of 2/18 ). Nothing is quarantined, just connection terminated so no files to submit for analysis.

    If this is a false pos. is there a way to allow the website?

    Any advice? Thanks
    Last edited by a moderator: Feb 19, 2009
  2. Rmuffler

    Rmuffler Former Eset Moderator

    Jun 26, 2008
    San Diego, CA USA
    Hello stabako,

    1. Open NOD32 and press F5.
    2. Click Antivirus and antispyware -> Web access protection -> HTTP -> Excluded addresses.
    3. Click Add and enter in the URL address.

    Thank you,
Thread Status:
Not open for further replies.