hmmmm, false positive?

Discussion in 'NOD32 version 2 Forum' started by citrus, Jan 10, 2006.

Thread Status:
Not open for further replies.
  1. citrus

    citrus Registered Member

    Joined:
    Sep 13, 2004
    Posts:
    11
    Location:
    Hannover - Germany
    Hi folks and ESET Guys,

    Amon gave me an alert this evening:

    10.01.2006 20:41:07 AMON Datei C:\Programme\Password Safe and Repository Personal Edition\psr.exe NewHeur_PE Virus

    I am wondering, because this program ist a trusted application from company:

    www.mafis.de or www.passwordsafe.de

    At earlier scans last week there was no alert at this file. Alert is comming up even with a fresh downloaded installation file from their website.
    File is already send to eset analysis. Happy Byte, could you please verify this? Thanks.

    citrus
     
  2. pykko

    pykko Registered Member

    Joined:
    Apr 27, 2005
    Posts:
    2,236
    Location:
    Romania...and walking to heaven
  3. citrus

    citrus Registered Member

    Joined:
    Sep 13, 2004
    Posts:
    11
    Location:
    Hannover - Germany
    Thanks pykko,

    i have already scanned this file earlier at www.kaspersky.com. But here are the results of the jury:

    This is a report processed by VirusTotal on 01/10/2006 at 21:53:52 (CET) after scanning the file "psr.exe" file.

    Antivirus Version Update Result
    AntiVir 6.33.0.77 01.10.2006 no virus found
    Avast 4.6.695.0 01.09.2006 no virus found
    AVG 718 01.10.2006 no virus found
    Avira 6.33.0.77 01.10.2006 no virus found
    BitDefender 7.2 01.10.2006 no virus found
    CAT-QuickHeal 8.00 01.10.2006 no virus found
    ClamAV devel-20051123 01.10.2006 no virus found
    DrWeb 4.33 01.10.2006 no virus found
    eTrust-Iris 7.1.194.0 01.09.2006 no virus found
    eTrust-Vet 12.4.1.0 01.10.2006 no virus found
    Ewido 3.5 01.10.2006 no virus found
    Fortinet 2.54.0.0 01.10.2006 no virus found
    F-Prot 3.16c 01.10.2006 no virus found
    Ikarus 0.2.59.0 01.10.2006 no virus found
    Kaspersky 4.0.2.24 01.10.2006 no virus found
    McAfee 4671 01.10.2006 no virus found
    NOD32v2 1.1358 01.10.2006 probably unknown NewHeur_PE virus
    Norman 5.70.10 01.10.2006 no virus found
    Panda 9.0.0.4 01.10.2006 no virus found
    Sophos 4.01.0 01.10.2006 no virus found
    Symantec 8.0 01.10.2006 no virus found
    TheHacker 5.9.2.071 01.10.2006 no virus found
    UNA 1.83 01.10.2006 no virus found
    VBA32 3.10.5 01.10.2006 no virus found

    It seems, that ist an false positive from my lovely nod32. I have no other explanation...

    citrus
     
  4. pykko

    pykko Registered Member

    Joined:
    Apr 27, 2005
    Posts:
    2,236
    Location:
    Romania...and walking to heaven
    Well, perhaps! It will be fixed I hope! ;)
     
  5. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    Yep, it will be fixed most likely in the upcoming update. 2 FP after the last AH update is really not that bad, taking into account that proactive detection of rootkits has improved significantly.
     
  6. dog

    dog Guest

    One unsupported bashing guest post has been removed, along with a reply by a member (which was only removed as it would have been out of context without the removed post). Any further senseless bashing posts will be removed without notice.

    Regards,

    Steve
     
  7. Bubba

    Bubba Updates Team

    Joined:
    Apr 15, 2002
    Posts:
    11,271
    Totally off topic\troll post removed. Any further like posts will be removed without comment.
     
Thread Status:
Not open for further replies.