Anti-rootkit: IceSword 1.22

[Guest]

[gibran]

Icesword 1.22 Homepage: http://www.antirootkit.com/software/IceSword.htm

is detected as Anti.Genetik2.IceSword.1220@72508 and thus deleted by CIS 3.5.50676.393 Realtime scanner.

Information about AV signature DB version is N/A but I can confirm that the signature was updated before scanning.

[darkmax]

Dude.... you are confusing me... is Icesword a anti-rootkit program, or is it being treated as a rootkit by CFP?

[3xist]

Dude.... you are confusing me... is Icesword a anti-rootkit program, or is it being treated as a rootkit by CFP?

Icesword is a legit anti-rootkit prog and it being reported as a malware by CAV 3 in CIS. That's what we call False Positives.  

Josh

[WaterWall]

It's not a 100 % false postive IMO. In bad hands, this tool can do harm. Same as the desktop viewing software 

[gibran]

It's not a 100 % false postive IMO. In bad hands, this tool can do harm. Same as the desktop viewing software 

Yep I guess I somewhat filed something incorrectly.

I don't know the CAV threat taxonomy but there should be many categories for various types of codes.

Icesword belong to the Anti class Genetik2 subclass (don't ask me what this mean)

A related submission would be:

CIS detects the file fdiag.exe (from FreshDiagnose a product by FreshDevices) as being the malware Anti.Fdiag.02[ at ]57609

I guess that's a false positive.

FreshDiagnose too belonged to that Anti class

The only reason I reported that because it was deleted due to "Automatically delete threats found after scanning"

I posted a related wishlist in CIS beta wishlist topic.

[Tags:]