Generic.dx Trojan detected

[edombowsky]

Today my McAfee Virus Scan Version 8.0.0.0 detected the Generic.dx Trojan within LaunchBar Commander.  My database is the March11, 2008 version.  So I downloaded a new copy from the DonationCoder website and just unzipped it and ran a virus scan on the files.  It again detected the Generic.dx Trojan.

Has any one else had this problem?

[mouser]

i've just re-downloaded the launchbar commander setup program -- it has not been modified by anyone, and this is indeed the release from my computer created in August 2007, when the last release of LaunchBar Commander occurred.

This is a false alarm -- probably due to the fact that LBC is packed with PECompact.  I'm so sick of these damn antivirus programs giving people false fears -- it's so harmful to developers.  It's fine if they want to tell people that they don't know how to analyze a file, but it's not cool to scare people into thinking that a real virus has been detected. 

The problem is that there is no incentive for antivirus programs to not flag everything they dont understand as a virus -- no one penalizes or gives bad marks to an antivirus program that false alarms constantly -- i wish they did.

I've basic gave up packing all my programs because i got sick of the BS from the antivirus programs, but the LBC release was old enough that it's still packed.

I'll try to put up a new version, unpacked, next weektoday if possible, just to reassure people.  But there is nothing wrong with the current version.  If you wait a few days McAfee might get updated and change its mind -- or try another antivirus to convince yourself everything is ok.

[mouser]

a funny related article: http://www.neowin.net/news/main/06/03/13/mcafee-to-users--excel-is-a-virus

also, "Developer considers McAfee suit after 'Trojan' error": http://news.zdnet.co.uk/software/0,1000000121,39166163,00.htm

[mouser]

This may reassure you, it's a great free online service that can scan a file with a dozen different antivirus tools.


(the annotation is mine)

And another from here:

[mwb1100]

I'm reluctant to bring this up because I'd hate to add to Mouser's bad day...  but apparently this false positive also affects Clipboard Help & Spell.

[mouser]

it's affecting all of my programs -- i wonder if it isn't triggering on c++ builder compiler created programs.
what's the best part -- McAfee doesn't just "warn" about the detection, it just outright deletes the file.  Big thumbs down for McCrapfee.

I spent some time trying to find out how to report false positives to them -- best i found was an email address with an automated unhelpful reply.  My brief encounter with McCrapfee has left me with 0 respect for it.

[mouser]

Ok I stand by my comment that McAfee = McCrapee because of the automatic deletion, the bad mistake they made with this false positive, and by not having a better system of alerting the user when a brand new definition has found something suspicious.

I will give them credit however for a fast reply to my submitted file.  Just got this in the mail:

> Thank you for submitting your suspicious file.
> Synopsis -
> Our Senior Virus Research Engineers have examined the file in question
> and no virus was found.
> Solution -
> Attached is an extra.dat with correct detection.  This correction will
> be included in the next DAT update.

SO, at least they have a good system in place to evaluate reported false positives -- now let's see how fast they push through the update.

For those that are interested and don't want to wait for that, i will attach the EXTRA DAT file sent to me.
Instructions for installing it are here: http://vil.mcafeesecurity.com/vil/systemhelpdocs/extradat.aspx

[mouser]

I'm going to lock this thread so any further discussion of the issue occurs on the more general new thread here:
http://www.donationcoder.com/forum/index.php?topic=12614