12 replies to this topic

[ProTruckDriver]

Please check the following update:

Database Version 7994 - 11-28-2011

Heur.Agent/Gen-FakeIE

When running real-time protection, shuts down IE-8. With Alert from SAS.
After full scan with or without real time protection on nothing found.
Cannot open IE with real time on.Get alert
With real-time off, IE-8 works fine.

This just happened when the update came in.

[skoop]

Also there with update 7995 Nov.28 2011

Unable to access IE 8 with Real Time Protection on.

[rogerthehart]

Same here! False positive on legit IE8 process running on Windows 7 32bit.
Database version 7995 trace 5807

[Equipped Solutions]

Same here on Win XP Pro SP3 machine. I have update 7995/5807 dated 11/28/2011 on Vista and Win 7 machines on same network as XP problem machine, and they are running IE8 without any problems. (Haven't come to grips with IE9 yet)

Wondering if it truly is a false positive....

[Equipped Solutions]

POSSIBLE RESOLUTION

I added the blocked Heur.Agent/Gen-FakeIE to the allow list in SAS - started IE8 and disabled a few of the add-ons in IE - like Google SideBar, Google updater, and a few others that seemed unnecessary. Sorry I can't be more specific, as I wasn't paying real close attention as I was disabling them.

Also, I went to the Advanced tab in IE's Internet Options and clicked "Restore Advanced Settings" and "Reset.." to assure everything is set at default.

Closed IE8, removed the Heur.Agent/Gen-FakeIE from the Allowed/Trusted list in SAS preferences. Assured realtime protection is still enabled in SAS.

Now IE8 opens up fine without any warning or blocking of Heur.Agent/Gen-FakeIE.

Hopefully this will help the others having this issue.

My guess is it's an add-on for IE8 that is either infected or a False Positive.

Just wish I paid closer attention to which ones I disabled. (DOH!)

[tng5737]

Same here just started with last update - I've run scans with MawlwareBytes and MSE with nothing found! I'm using Firefox now.

[Ramie]

I am also getting the same error message. Running Windows XP. IE version 8.0.6001.187002. I am not running any add-ons. I did have a shortcut on the menu bar, which caused the error everytime. When I start via my desktop, I get no error. Wonder if the fact that I was using a copy of a shortcut could have an issue?

[Asrial]

Add me to the list. Customer is using XP.

More details to come shortly...

[EDIT: IF my customer's computer is infected.. I can't see anything. I don't even see anything abnormal occurring.]

[SAS Customer Service]

I will let the guys know!

[ProTruckDriver]

I will let the guys know!

Thank you

[SAS Customer Service]

Update your definitions, should be fixed now!

[ProTruckDriver]

It's fixed, Thank you.

[Asrial]

I updated my customer. If you don't hear back from me, that means my situation is also solved

Thanks for the quick action!