Kaspersky not correcting false positive

Hi everyone,

I got that one program from a dating site from a Dutch newspaper which would basically stay in your system tray and inform you about online contacts / new messages (www.nextlover.nl). Very small and absolutely harmless.

Kaspersky detects it both by heuristics and with PDM if you turn off heuristics as trojan. In automatic mode its deleted automatically.

I reported it to Kaspersky and got confirmation that it's no malware. But it was still detected. I wrote again. Then I thought it was fixed, but now it is been detected again. When I write to Kaspersky Lab they tell me it is not detected.

Well that is funny cause it is still deleted anytime I try to download it even. Of course there are ways to work around that I guess. But in my opinion they should be able to fix a false positive, shouldn't they? It's now more than one month that I reported it to them.

In the light of the recent tests and user reports of increasing false positives this worries me.

It's ok not to detect 100%, or to have false positives. But imo vendors should correct if customers report. I always thought that was Kasperskys strong point. And that is one of the reasons I switched to them in the first place. Now I might as well go back to Norton ...

 

try to add the program to exclusions so that kaspersky won't bother u again

 

did you state in the email it is a false possitive?

 

@icr - I know this would work. But this is about principles. I just find it worrysome that they don't correct false positives. Maybe they are not able to because it would mean altering heurstic detections too much, I don't know about the technical difficulties. Either way it is dissatisfying.

@lodore - Yes I mentioned that they told me themselves it is not malicious.

 

What exactly are the detections on this program?

 

Here there are 2 screenshots.

 

First one is a heuristic thing, so that can be fixed.... second one is a behavioural detection (which probably won't be fixed, because it's behavioural- BUT if the application is added to the HIPS trusted applications whitelist then it should be allowed by default)

I'll have a word regarding the heur. detection.

 

Hi Baz,

A small correction here. Trojan.Generic is a PDM verdict, placing the application to the HIPS Trusted group won't have an effect on the PDM alerts, they'd still be shown. The only thing which should influence if the user is alerted (from PDM) is the "Do not notify..." option in the PDM. (and clearly, this app doesn't have a digital signature; if the user hasn't disabled the "Do not notify..." option which I don't think is the case)
Instead, the application should be placed in the Trusted Zone with the corresponding rules created.

 

Cheers for correction.

Abeltje: I will get in contact with one of the developers who deals with Heuristics on Monday to try and get this one sorted, thanks for the information.

 

Heur. detection is fixed with latest update.

 

Wow, indeed! No alarm anymore! Thanks very much Baz!