Nod32 V3 Latest Build sees Integrator 1.5.1 as Threat

[casey]

This happens every time I try to download / open or Run the Integrator
I Have submitted the file to Eset.
Told them it is from a trusted source !
:confused:

[gryffin53]

I have the same issue.. Using NOD32 2.70.39 2931

[ianymaty]

Same to me, Using NOD32 2.70.39 2931

[Siginet]

I'l send a notification to nod32 as well. Please report it to them too so that we can get them to fix this asap.

Thanks for letting me know.

[newsposter]

Nod and Clam are notorious for their false positives.

Not to say that Trend, McAfee, and others don't false from time to time to time, those two seem to do it a hell of a lot more.

[gryffin53]

Nod and Clam are notorious for their false positives.

LOL, this is actually the first time I see the red NOD screen on my pc :-D

[Siginet]

This sucks because I am a fan of nod32. :(

[squishy]

It really does suck. NOD32 should ALWAYS leave a user in FULL control of his/her machine.

There needs to be a "Mark This File As Safe" button on the NOD32 threat screens that allows a user to mark a file as safe (essentially automating the task of telling NOD32 to exempt a file).

I don't give a rat's food ejection port for any software that takes away my ability to govern my PC. If I screw it up, that's on me. It's not a decision that Eset should force on it's users - especially concerning the number of false positives that NOD32 throws up.

[gryffin53]

Apparantly they fixed this.. I have virus signature database 2941.

[ianymaty]

Yes, I think they fix the problem, I've download it without NOD32 complaining about anything. Thx ESET.
Thank you Siginet!

[Siginet]

Apparantly they fixed this.. I have virus signature database 2941.


Yes, I think they fix the problem, I've download it without NOD32 complaining about anything. Thx ESET.
Thank you Siginet!

That's music to my ears! :D Thx everybody!

[spinejam]

updated virus def's remedied. :D

[gryffin53]

There's again a false virus report of RVMI 1.5.3 with NOD32 virus database 3027.. I'm really getting sick of this :evil:

[Siginet]

WTF..??!! Is this gonna start happening with every release now? I am beginning to not like nod32 very much if it is this simple for it to flag a file as a virus. There is nothing in the integrator even remotely close to a virus.

Please report it to them if you can. Thx for letting me know.

[rmvw]

also with NOD32 virus database 3029

[gryffin53]

It's still not fixed with nod32 virus database 3041. These guys really are going the wrong way..:(

[newsposter]

Both nod and avast will flag ALL compiled/scripted applications as virii *unless* there is an exception hard coded into their virus definition files.

It's known that while nod and avast are able to find and defeat a lot of crap, they do it with an unintelligent comparison-to-threat mechanism rather than an actual code-analysis method like the payware antivirus applications do.

So yes, this will be an on-going problem.

I personally love free applications that have large followings. But there are limits to what can be handed out free and what needs to be paid for.

[Siginet]

The sad part here is nod32 is not free. There are only 3 AV programs according to http://virustotal.com that are flagging RVM Integrator v1.5.3 as a so called virus. Actually nod32 is flagging it as a corrupt archive. Which is really stupid... cause it isn't even an archive it's an executable.

From what I hear virustotal is a site we can go to, to submit the integrator and it is evaluated by all of the major Antivirus companies. So since it has been submitted this should hopefully be fixed soon. Do your part by re-submitting it yourselves too... so we can get this fixed quickly.

You can also send an email to eset here:
http://www.eset.com/support/contact.php

[ivanhorvat]

Hi,

here is today's status with virus signature database 3043 0f 21-Apr-2008.

================================================== ========
ESET NOD32 Antivirus - Web protection alert
Threat detected !

Threat details:

Web page:
http://integrator.siginetsoftware.com/data/download.php?id=1

Threat:
Win32/Packed.Autoit.Gen application

Comment:
Access to the web page was blocked by ESET NOD32 Antivirus.

www.eset.eu

================================================== ========

Obviosly ESET does not care what legal users need or want.

Best regards,
Ivan

[dumpydooby]

I came here to note that I am having the same problem with Virus Signatures 3080 while downloading RVM_Integrator_1.5.3.rar, and while trying to extract the RAR as well.

[dumpydooby]

lol. I can only post URLs once I have at least two posts. So... here is my second post.

[dumpydooby]

NOD32 displays a false positive for the RyanVM Integrator. This program is used for aiding in mass deployment environments, which would ironically include the deployment of anti-virus applications such as those carried by ESET.

This application has been scanned by numerous third parties (Softpedia, for example). It is a harmless application, and this is most definitely an error on your end.



Here is a relevant discussion regarding the false positive:
http://siginetsoftware.com/forum/showthread.php?t=309


Here is the home page for the product in question:
http://integrator.siginetsoftware.com/index.php?info
That's the message I sent them. I didn't want to really attack them or threaten to switch to someone else because, quite honestly, I likely won't. But I do think they should definitely consider fixing the problem.

[Siginet]

Thanks dumpydooby

[cromag]

I have nod32 with defs 3117 and it blocks integrator from downloading :( They may have fixed in earlier defs but its now blocking the newest (1.5.3) as a Win32/Packed.Autoit.Gen application...whatever that means. Soo...I'm just going to kill eset until i'm done doing what I need to do and see how that works.

Also...I was wondering if there is a problem on siginet's end because everytime i try and download, it tells me the source file cannot be found.

[Siginet]

The download seems fine for me.

As for nod32... I don't know what else to do. They have been notified by many integrator users... but they are still flagging it. :(

[dumpydooby]

I've sent them more emails and I've gone through the routine of submitting a false positive notice.

I encourage all users of Eset products to go through the routine of submitting a false positive notice.


How to submit virus or potential false positive samples to ESET's labs

We are very interested in receiving virus samples in order to better protect our customers. To submit a suspicious file to ESET for analysis, please follow these steps:

Compress the file(s) into a .zip or .rar archive, and password protect it with the password “infected”.


Make a note of this password in the email, attach the zipped file, and email it to samples@eset.com (samples@eset.com).


Use a subject line which clearly states if the attached file contains a suspected infection or a false positive. Also, please include the Customer Care case number if applicable.


In the body of the email it is very important to include:



Any background information as to where the sample was found
Why you think it is malware or a false positive report.
If you know that another antivirus company already detects it.
If you are reporting a potential false positive, please provide as much information as possible about the source of the software, including the name of the developer, the name and version application and the address of the site from which the file was downloaded.

Taking the above steps will greatly assist our labs in the process of identifying and processing samples. If the issue is not resolved within two days and the matter is urgent, please send a follow-up email message with the following information:


subject line of email that was sent to samples@eset.com
date and time of email
email address you sent it FROM and email address you sent it TO.


-Thank you for helping ESET better protect its customers!

Instead of password-protecting the file with the password "infected," I made the password "NOTinfected" and made sure to note it, per step (2): "Make a note of this password."