Jump to content
Sign in to follow this  
JVRudnick

False Positive from my own VB6 application?

Recommended Posts

I run the SASPro (latest version, updated nightly) every nite. In the past 9 days, it's been finding what it is calling "trojan.agent gen-koobface(bonkers)" in a .exe file.

This is incorrect, ie it's a false positive. I know - as I wrote that app myownself in VB6 about 3 years ago, and it simply copies files from a reporting app, and u/l same to one of our servers. In no way, is it anything -- and I mean ANYTHING -- like the trojan, which I've now read up on, online.

My issue appears to be that somehow SASPro, thinks it is and continues to toss away a shortcut that I've put on the desktop now everyday since 9 days ago. SASPro does not remove the real app itself (path to same is C:\Program Files\Automation-4-10\automation_source-files) nor does it remove any of the VB files, backups etc etc. etc. All it does is toss the shortcut to that Automation.exe file.

So, I thought, hmm...well then I'll just make my desktop an exception... which I've tried to do via the Manage Excluded folders....which also seems to have worked...at least for the past 3 nights.

So, question is why would SASPro get this false positive?

Jim

Share this post


Link to post
Share on other sites

I run the SASPro (latest version, updated nightly) every nite. In the past 9 days, it's been finding what it is calling "trojan.agent gen-koobface(bonkers)" in a .exe file.

This is incorrect, ie it's a false positive. I know - as I wrote that app myownself in VB6 about 3 years ago, and it simply copies files from a reporting app, and u/l same to one of our servers. In no way, is it anything -- and I mean ANYTHING -- like the trojan, which I've now read up on, online.

My issue appears to be that somehow SASPro, thinks it is and continues to toss away a shortcut that I've put on the desktop now everyday since 9 days ago. SASPro does not remove the real app itself (path to same is C:\Program Files\Automation-4-10\automation_source-files) nor does it remove any of the VB files, backups etc etc. etc. All it does is toss the shortcut to that Automation.exe file.

So, I thought, hmm...well then I'll just make my desktop an exception... which I've tried to do via the Manage Excluded folders....which also seems to have worked...at least for the past 3 nights.

So, question is why would SASPro get this false positive?

Jim

you should use the built-in false positive reporting so we can correct it, if you do that we correct it immediately.

Share this post


Link to post
Share on other sites

And how do I "do" that...I cant find out anywhere to send you that 'false positive?'

???

Jim

you should use the built-in false positive reporting so we can correct it, if you do that we correct it immediately.

Share this post


Link to post
Share on other sites

FAQ: I think SUPERAntiSpyware detected something it should not have. What do I do?

All spyware and virus scanners from time to time detect what is called a "false positive". A false positive is when the scanner detects a harmless file as an infected file.

If you believe SUPERAntiSpyware has improperly detect a file as harmful, please use the built-in false positive reporter in SUPERAntiSpyware to send a sample of the file directly to our definitions team. The false positive reporter is available at the end of a scan. The item must be detected during the scan, not in quarantine.

At the end of the scan, click once on the item to be submitted to highlight it, and click the "Report False Positive" button to the right.

IMGSASScanning2.gif

The file will be submitted to the SUPERAntiSpyware team for analysis. If it's found to be benign, it will be excluded from SUPERAntiSpyware's definitions.

Share this post


Link to post
Share on other sites

I've just forwarded same...as SAS found it once more...

And would muchly appreciate the "all clear" on this false

positive too!

:|

Jim

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

×
×
  • Create New...