Main Area and Open Discussion > General Software Discussion

False Positive on Software (Generic.Dx) by McAfee Today: McAfee Response and Fix

<< < (5/13) > >>

mouser:
Here's the support email of the mcafee antivirus labs where they deal with false positive issues:

* Virus Research <[email protected]>
I encourage everyone to email them and let them know how unhappy they are with the sloppiness and irresponsibility of McAfee, with regard to these regular false positive things.

mouser:
One thing is clear.. McAfee is garbage.  I suggest people using it find a better antivirus.

These episodes have proven that McAffee:
1) Is sloppy and untrustworthy -- they clearly are not putting any care into adding antivirus signatures.
2) Has a horrible policy of deleting files that they have the slightest suspicion about.
3) Have no interest in treating users with the slightest intelligence (they dont tell you why they are doing what they are doing, nor give you any options, nor tell you the difference between a high and low confidence detection).

mouser:
Reply from McAfee:

  Thank you for your email. We are aware of this issue and it should be
resolved in tomorrows DAT release. In the meantime I am escalating your
issue to our senior researchers. Please use the attached Extra.dat to
possibly negate any identification on your system. I tried downloading
the file for Screenshot Captor, but was unable to reproduce detection on
the file. If this extra.dat does not work, I request you to please
submit the file which is causing a mis-detection.
--- End quote ---

I've attached the latest extra.dat file.

EXTRA.zip (0.26 kB - downloaded 1225 times.)

And instructions from kelibeck above:

How to install an EXTRA.DAT
Summary: This document will explain how to apply an EXTRA.DAT file.


Affected Suites: Affected Products: Affected Operating Systems:
Total Protection
Internet Security Suite
PC Protection Plus
VirusScan Plus
 VirusScan
 Windows 2000
Windows XP
Windows Vista

 

Description
EXTRA.DAT files contain information that is used by VirusScan to detect new viruses. When a major virus is discovered, and extra detection is required, an EXTRA.DAT file is made available until the normal VirusScan update is released.

EXTRA.DATs can be downloaded from the the Newly Discovered Threats page, the Recently Updated Threats page, or the Removal Instructions section of the description for the major virus. When an EXTRA.DAT file is added to the VirusScan folder on your hard drive, it is used by the product, in addition to the normal DAT files, to detect the new virus. This enables VirusScan to protect your computer from the new virus until the official update is released that contains the virus detection/removal information. After the official update is released and installed, the EXTRA.DAT file is no longer necessary.

EXTRA.DAT files are good for 14 days, at which time they disable themselves. McAfee recommends you keep your VirusScan up to date by downloading and installing the official daily updates.

Solution
EXTRA.DAT instructions
EXTRA.DAT should be copied into the same directory where avvclean.dat, avvnames.dat, and avvscan.dat are.

For example:
C:\Program Files\McAfee\VirusScan\DAT\xxxx.x
(where xxxx.x is the DAT version number)

Note: For Windows Vista 64-bit computers, the directory is: C:\Program Files (x86)\McAfee\VirusScan\DAT\xxxx.x.


Restart your computer.
Additional information can be found at the McAfee Threat Center: http://vil.nai.com/vil/systemhelpdocs/extradat.aspx.
--- End quote ---

bassclarinetl2:
Mcafee isnt the only one,  Kaspersky just flagged one of skrommel's utilities as having a backdoor. 

Well I downloaded v136  and kaspersky seems to like is so who knows what up with that.

xcopy:
Thanks a lot mouser for going through all the trouble for us.  :up:

I had that false positive today with Launchbar Commander.
But this is developing into a workflow: Starting the PC, checking what McAffee killed today, visiting this forum, feeling with you, loading the extra.dat file, restarting the system, resinstalling the deleted program, feeling warm and cozy again and thinking of the good old days when I used F-Secure.  ;)

Navigation

[0] Message Index

[#] Next page

[*] Previous page