Sage MAS90 CHM file

Discussion in 'NOD32 version 2 Forum' started by fmtost, Apr 24, 2008.

Thread Status:
Not open for further replies.
  1. fmtost

    fmtost Registered Member

    Joined:
    Apr 24, 2008
    Posts:
    2
    I've got version 4.20.11 of Sage MAS90 and NOD32 is flagging one of its help files (po.chm) as containing a variant of the Perl/HackTool.Swez trojan. I verified that this is the file that is installed by the MAS90 setup program. Sage seems to be assuming that either the file was infected after installation or that this is a false positive. The person assigned to talk to me with this sent me his version of that file and NOD has no problems with it. Has anyone else seen this and can it be confirmed as either a true virus or as a false positive? I've got version 2.71 of NOD with signature file 3052 (20080424).
     
  2. agoretsky

    agoretsky Eset Staff Account

    Joined:
    Apr 4, 2006
    Posts:
    4,032
    Location:
    California
    Hello,

    Can you please send a copy of the file in question in a .ZIP or .RAR file protected with a password of "infected" to samples@eset.sk? This will allow the virus lab to examine the file and determine why it is being flagged. Be sure to mention it is a suspect false positive alarm in the Subject: line and include a link to this message thread.

    Regards,

    Aryeh Goretsky
     
  3. edscape

    edscape Registered Member

    Joined:
    Jul 19, 2008
    Posts:
    2
    I have the same issue with the exact same file was the po.chm submitted and was confirmed as a false positive or real a trojan?

    thanks
     
  4. ASpace

    ASpace Guest

    You'd better submit the file youself . The thread is too old to expect an answer from the OP .
     
  5. edscape

    edscape Registered Member

    Joined:
    Jul 19, 2008
    Posts:
    2
    Thanks I sent the instructions posted by Aryeh Goretsky
     
Thread Status:
Not open for further replies.