False positives 3970

Discussion in 'ESET NOD32 Antivirus' started by edwin3333, Mar 27, 2009.

Thread Status:
Not open for further replies.
  1. edwin3333

    edwin3333 Registered Member

    Joined:
    Aug 29, 2007
    Posts:
    244
    We are a VB / .NET shop.

    Pattern file 3970 is false positiving on VB6 as vm.nzw trojan.

    Joy!
     
    edwin3333, Mar 27, 2009
    #1
  2. elapsed

    elapsed Registered Member

    Joined:
    Apr 5, 2004
    Posts:
    7,076
    Um, odd. Which files? Have you sent them off?
     
    elapsed, Mar 27, 2009
    #2
  3. johnpd

    johnpd Registered Member

    Joined:
    May 23, 2004
    Posts:
    80
    I am receiving the same thing on the file C:\Windows\setup1.exe. The file has been on my system for a while (date modified from over a year ago). I ran a scan on the file with both Malwarebytes and Spybot and they found nothing. I sent the file in to ESET.
     
    johnpd, Mar 27, 2009
    #3
  4. gaslad

    gaslad Registered Member

    Joined:
    Feb 18, 2007
    Posts:
    117
    Location:
    Toronto, Ontario
    Same here.

    The detection occured during an MBAM scan just now.

    From my Nod32 log:

    27/03/2009 6:25:32 PM
    Real-time file system protection
    file C:\WINDOWS\Setup1.exe Win32/VB.NZW trojan
    cleaned by deleting - quarantined
    Event occurred during an attempt to run the file by the application: C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe.
     
    gaslad, Mar 27, 2009
    #4
  5. FanJ

    FanJ Updates Team

    Joined:
    Feb 9, 2002
    Posts:
    4,813
    NOD32 v2, defs 3970, XP home SP3

    Same problem here:

    C:\WINDOWS\Setup1.exe - Win32/VB.NZW trojan

    And more:

    FP's on installation files of programs of KarenWare:

    D:\KarenWare\Disk Slack Checker\Version 2_5_2\ptslack-setup.exe »ZIP »PTSlack.CAB »CAB »SETUP1.EXE - Win32/VB.NZW trojan

    D:\KarenWare\Drive Info\Version 2_3_1\ptdinfo-setup.exe »ZIP »PTDInfo.CAB »CAB »SETUP1.EXE - Win32/VB.NZW trojan

    D:\KarenWare\URL Discombobulator\Version 1_9\ptlookup-setup.exe »ZIP »PTLookup.CAB »CAB »SETUP1.EXE - Win32/VB.NZW trojan

    For KarenWare, see:
    http://www.karenware.com/powertools/powertools.asp

    I will inform Karen.
     
    FanJ, Mar 27, 2009
    #5
  6. FanJ

    FanJ Updates Team

    Joined:
    Feb 9, 2002
    Posts:
    4,813
    The file Setup1.exe is a Microsoft file.
     

    Attached Files:

    FanJ, Mar 27, 2009
    #6
  7. FanJ

    FanJ Updates Team

    Joined:
    Feb 9, 2002
    Posts:
    4,813
    MD5 checksum (at least on my system):

    The file C:\WINDOWS\Setup1.exe has the following Checksum(s)

    MD5 - C6264B17629F6F9F0BD2BA7671CEFF69
     
    FanJ, Mar 27, 2009
    #7
  8. FanJ

    FanJ Updates Team

    Joined:
    Feb 9, 2002
    Posts:
    4,813
    Give me a moment and I'll submit it too.
     
    FanJ, Mar 27, 2009
    #8
  9. xMarkx

    xMarkx Registered Member

    Joined:
    Dec 1, 2008
    Posts:
    446
    Is 3970 bugged like 3901 and 3918 were earlier this month?
     
    xMarkx, Mar 27, 2009
    #9
  10. elapsed

    elapsed Registered Member

    Joined:
    Apr 5, 2004
    Posts:
    7,076
    I wouldn't really call this anywhere near as serious as 1918, because 3918 should have been caught by testers where as this is much harder to catch.
     
    elapsed, Mar 27, 2009
    #10
  11. FanJ

    FanJ Updates Team

    Joined:
    Feb 9, 2002
    Posts:
    4,813
    Ough :rolleyes: this is a Microsoft file ...
     
    FanJ, Mar 27, 2009
    #11
  12. FanJ

    FanJ Updates Team

    Joined:
    Feb 9, 2002
    Posts:
    4,813
    About 8 hours after the first posting about this and no reply from ESET in this thread on its official forum and no fix and the weekend is coming .....
     
    FanJ, Mar 27, 2009
    #12
  13. johnpd

    johnpd Registered Member

    Joined:
    May 23, 2004
    Posts:
    80
    ESET issued a new Def set (3971) but the issue still exists.
     
    johnpd, Mar 28, 2009
    #13
  14. xan K

    xan K Registered Member

    Joined:
    Sep 15, 2008
    Posts:
    154
    Location:
    Dominican Republic
    I can confirm the issue is still here. NOD32 just performed an scan and detected setup1.exe as a "Win32/VB.NZW trojan".
     
    xan K, Mar 28, 2009
    #14
  15. FanJ

    FanJ Updates Team

    Joined:
    Feb 9, 2002
    Posts:
    4,813
    In an hurry:

    It's fixed with defs 3972 :thumb:
     
    FanJ, Mar 28, 2009
    #15
  16. xan K

    xan K Registered Member

    Joined:
    Sep 15, 2008
    Posts:
    154
    Location:
    Dominican Republic
    yay, noticed it when I woke and first used the PC. well done.
     
    xan K, Mar 28, 2009
    #16
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...