# no response from possible false positive

Discussion in 'NOD32 version 2 Forum' started by enduser999, Sep 20, 2005.

Thread Status:
Not open for further replies.
  1. enduser999

    enduser999 Registered Member

    Joined:
    Apr 17, 2005
    Posts:
    418
    Location:
    The Peg
    I had recommended NOD32 to a friend but now I am wondering if I did the right thing. The friend runs ScoopScript an IRC client and have submitted a file twice to Eset that is causing problems with false positives. It is the configuration file (fs.ini) for ScoopScriot's built-in file servers that CAN be used. I have sent this file in to samples@eset.com twice and have heard nothing whatsover.
     
  2. jg88swe

    jg88swe Registered Member

    Joined:
    Jul 1, 2004
    Posts:
    181
    Yeah they often never awnsers to me either...

    feels like you are ignored when sending to eset so I stoped doing that... Maybe it's something you Eset guys should talk about because I think this is just one reason Eset isn't #1
     
  3. pykko

    pykko Registered Member

    Joined:
    Apr 27, 2005
    Posts:
    2,236
    Location:
    Romania...and walking to heaven
    Totally agree with you, jg88swe, that's the only thing ESET missed. :(
    Ading users samples is the best way to have a higher detection..if somebody sends you a sample it means that the virus is spreading if it has reached to a person so you must add it..that's my oppinion. :)
     
  4. enduser999

    enduser999 Registered Member

    Joined:
    Apr 17, 2005
    Posts:
    418
    Location:
    The Peg
    Ok thanks for the reply though it was just me. I have had my friend add the file in question to the NOD32 ignore list. I also think that the NOD32 GUI especially for the parameters for scheduled scanning needs work before less experienced users would even look at it to be their main anti-virus.
     
  5. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
    If you submit the file to VTotal, it will be detected by 3 other AV programs. Our engineers will analyse it and remove detection, if necessary. Usually we do not respond to samples sent, it's simply beyond a human to respond to dozens/hundreds emails per day.
     
  6. jg88swe

    jg88swe Registered Member

    Joined:
    Jul 1, 2004
    Posts:
    181
    aha..
    And that want I think have to change...

    Alteast some automatic response telling with diffrent Automatic messages what you've done with it.

    *Sample added in next update
    *False positive Removed
    *Sample contained no viral code

    Simple as that... Maybe you can look in to it

    Otherwise I would just send the Sample over and over again until I get a response and that's a waste of time for the engeneers.
     
  7. enduser999

    enduser999 Registered Member

    Joined:
    Apr 17, 2005
    Posts:
    418
    Location:
    The Peg
    What/who is Vtotal?
     
  8. Brian N

    Brian N Registered Member

    Joined:
    Jul 7, 2005
    Posts:
    2,148
    Location:
    Denmark
  9. enduser999

    enduser999 Registered Member

    Joined:
    Apr 17, 2005
    Posts:
    418
    Location:
    The Peg
    Submitted. Only Nod32,Avira and AntiVir say it is a Heuristic/Worm
     
  10. jg88swe

    jg88swe Registered Member

    Joined:
    Jul 1, 2004
    Posts:
    181
    Allright so what you guys are saying that the virus submissions to ESET labs should lay in the hands of VirusTotal?
    Corret?

    trash samples@nod32.com then
     
  11. Brian N

    Brian N Registered Member

    Joined:
    Jul 7, 2005
    Posts:
    2,148
    Location:
    Denmark
    I always thought it was sample@nod32.com (without the S), same one as they use on virusradar? hmm...
     
  12. pykko

    pykko Registered Member

    Joined:
    Apr 27, 2005
    Posts:
    2,236
    Location:
    Romania...and walking to heaven
    Well, OK....I'll submit all the samples to Virustotall....let's what happens....will they be added or not!
     
  13. Marcos

    Marcos Eset Staff Account

    Joined:
    Nov 22, 2002
    Posts:
    14,374
  14. enduser999

    enduser999 Registered Member

    Joined:
    Apr 17, 2005
    Posts:
    418
    Location:
    The Peg
    How long after a report of a false positive are the definitons updated to fix the problem? Since this is the Eset forum perhaps a sticky, if not already where to send questionable files and if appropriate a link to virustotal.com
     
  15. Firecat

    Firecat Registered Member

    Joined:
    Jan 2, 2005
    Posts:
    7,927
    Location:
    The land of no identity :D
    I believe that the report is at least investigated within a week, at the very least (depending on priority and severity etc.).....
     
  16. enduser999

    enduser999 Registered Member

    Joined:
    Apr 17, 2005
    Posts:
    418
    Location:
    The Peg
    Okay by report I assume that you mean the email to sample/samples@eset.com. I ask because the orignal report was sent there over 3 weeks ago.
     
Thread Status:
Not open for further replies.