False positive

smage · May 22, 2009, 5:34pm

Hi,

Please correct this false positive.

ThunderWatcher.exe

Detected as Trojware.Win32.MuDrop

Database 1187

Thanks

[attachment deleted by admin]

e_xistense · May 22, 2009, 5:58pm

Hi, Smage,

Thank you for reporting it. Please attach the exe sample here in order to check the FP.

Thanks,
Ionel

smage · May 23, 2009, 3:10am

Hi,
How do I get the exe file, I have quarantined it.
This is why I sent the link.

Install Thunder.exe
I think that it is a BoClean Fp because when I scan the file CAVS does not detect it, it is only when I install the file that the On access scanner detects it.
Thanks.

smage · May 23, 2009, 7:34am

Hi,
I have also attached the file.

[attachment deleted by admin]

e_xistense · May 29, 2009, 5:33pm

Hi, Smage,

The false positive was fixed and already reflected on DB 1215.

Thanks,
Ionel

smage · May 29, 2009, 6:00pm

Ok thanks.
Keep up with the nice work.

smage · May 30, 2009, 2:53pm

Hi,

This has not been fixed with DB 1220.

[attachment deleted by admin]

smage · May 31, 2009, 1:37pm

Same problem with DB 1224

smage · June 1, 2009, 11:44am

Hi,
A scan on VirusTotal shows that 11 companies are flogging this as malware.
Is this file really clean?
http://www.virustotal.com/analisis/a4eebaa56077fd6fba07e755815930e396ef53d67ee76cd79cba53e99693b6c3-1243856315

http://camas.comodo.com/cgi-bin/submit?file=a4eebaa56077fd6fba07e755815930e396ef53d67ee76cd79cba53e99693b6c3