Confused about the latest scan

I just updated to V5.2.9.1 I'm running Windows 7 Pro 32 bit Service Pack 1

Today I did a computer scan and the results said:
2 infected files / 0 cleaned files

I looked in the log and the 2 files are:

C:\Users\my pc\Downloads\PopUp Domination\popup-domination-stand-alone.zip » ZIP » popup-domination/installx/index.php - PHP/Obfuscated.F potentially unwanted application

C:\Users\my pc\Downloads\PopUp Domination\popup-domination.zip » ZIP » popup-domination/popup-domination.php - PHP/Obfuscated.F potentially unwanted application

This is a program I use on some of my websites ... I don't think there is anything infected with it So how do I stop NOD from flagging it ... though I guess it didn't delete or quarantine it ??

This week I had another issue with a plugin I was downloading - I will post that as a separate issue.

Thanks for your help!
Ellie

 

Hello Ellie!

Potentially Unwanted Application detections is a detection setting that is un-checked by default.
So you must have check that setting your self in the setup tree, or during the installation.

So in order to get rid of the detection simple go into the setup tree and uncheck the checkbox.

And PUA/PUP detections does not necessarily mean that the program is infected, but that it may behave in an unwanted and/or unexpected way.

If NOD32 did quarantine the files then you can simply restore them if you know they are clean.

FYI, This support article will surely answer a few questions....
http://kb.eset.com/esetkb/index?pag...earch&viewlocale=en_US&searchid=1345959916002

HTH SweX

 

I assume the files contain a script utilizing a code obfuscation exploited by malware writers for the purpose of evading detection.

 

Hi,

I found this thread by way of monitoring for PopUp Domination. I'm the new lead developer there and the obfuscated code being referred to is part of the installation process. It was put in place by a previous dev as part of his "security" measures to check license keys match. The whole system is about to be overhauled so that this check is performed in a better way. I'd be happy to show you the code if you're still worried (or run it through any online php de-obfuscator).

Hope that helps allay any fears.

Thanks

 

Truth is I always ran NOD right out of the box ... During setup I probably checked everything - thinking this is what I needed to do!!

Thanks for the link -- I did as it said ... so hopefully this clears it up.

 

Thanks for your response here...

 

Hello,


If you would like to submit the application to ESET's virus lab after you
are finished updating it, you can do so via the instructions listed in ESET Knowledgebase Article #141, "How do I submit a virus, website or potential false positive sample to ESET's lab?."

Regards,

Aryeh Goretsky