# no response from possible false positive

I had recommended NOD32 to a friend but now I am wondering if I did the right thing. The friend runs ScoopScript an IRC client and have submitted a file twice to Eset that is causing problems with false positives. It is the configuration file (fs.ini) for ScoopScriot's built-in file servers that CAN be used. I have sent this file in to samples@eset.com twice and have heard nothing whatsover.

 

Yeah they often never awnsers to me either...

feels like you are ignored when sending to eset so I stoped doing that... Maybe it's something you Eset guys should talk about because I think this is just one reason Eset isn't #1

 

Totally agree with you, jg88swe, that's the only thing ESET missed.
Ading users samples is the best way to have a higher detection..if somebody sends you a sample it means that the virus is spreading if it has reached to a person so you must add it..that's my oppinion.

 

Ok thanks for the reply though it was just me. I have had my friend add the file in question to the NOD32 ignore list. I also think that the NOD32 GUI especially for the parameters for scheduled scanning needs work before less experienced users would even look at it to be their main anti-virus.

 

If you submit the file to VTotal, it will be detected by 3 other AV programs. Our engineers will analyse it and remove detection, if necessary. Usually we do not respond to samples sent, it's simply beyond a human to respond to dozens/hundreds emails per day.

 

aha..
And that want I think have to change...

Alteast some automatic response telling with diffrent Automatic messages what you've done with it.

*Sample added in next update
*False positive Removed
*Sample contained no viral code

Simple as that... Maybe you can look in to it

Otherwise I would just send the Sample over and over again until I get a response and that's a waste of time for the engeneers.

 

What/who is Vtotal?

 

www.virustotal.com

 

Submitted. Only Nod32,Avira and AntiVir say it is a Heuristic/Worm

 

Allright so what you guys are saying that the virus submissions to ESET labs should lay in the hands of VirusTotal?
Corret?

trash samples@nod32.com then

 

I always thought it was sample@nod32.com (without the S), same one as they use on virusradar? hmm...

 

Well, OK....I'll submit all the samples to Virustotall....let's what happens....will they be added or not!

 

samples@eset.com or sample@eset.com, it doesn't matter. both are checked

 

How long after a report of a false positive are the definitons updated to fix the problem? Since this is the Eset forum perhaps a sticky, if not already where to send questionable files and if appropriate a link to virustotal.com

 

I believe that the report is at least investigated within a week, at the very least (depending on priority and severity etc.).....

 

Okay by report I assume that you mean the email to sample/samples@eset.com. I ask because the orignal report was sent there over 3 weeks ago.