False Positive: POSTGRESQL service detected as Trojan.Agent/Gen-Falcomp

[BrendanPrice]

Hi guys,

 

I maintain a medical software package that includes a PostgreSQL backend. Recently one of our customer's systems stopped functioning because SuperAntiSpyware had detected and removed the Postgres service.

Trojan.Agent/Gen-Falcomp
(x86) HKLM\System\CurrentControlSet\Services\ARGUSPOSTGRESQL
C:\PROGRAM FILES (X86)\ARGUSCONNECT\SERVER\POSTGRESQL 8.4\BIN\PG_CTL.EXE
(x86) HKLM\System\CurrentControlSet\Enum\Root\LEGACY_ARGUSPOSTGRESQL

I have attached a sample of the pg_ctl.exe file.

 

http://www.argusconnect.com.au/

pg_ctl.exe

[BrendanPrice]

Apparently it also deletes the postgres.exe executable as well. I can't attach a sample as the file is 4.5mb. This is a VERY widely used database backend. See http://www.postgresql.org/

[marysalvador]

I have been working on getting this software up and running for many hours....I need this software, I have tied restoring my computer, allowing/trust the "Trojan", stopped real time protection, I guess I will have to uninstall my spyware.....this is not a good thing.
 

[marysalvador]

I uninstalled SUPERAntispyware and still can't use my RADAROPUS,  oh, Chris, here I come!  LOL  (support for my software)

[marysalvador]

_{okay, I had to uninstall SUPERAntispyware, uninstall my software, reinstall RADAR OPUS,  and now I have lost all of my patient files....my backup was erased!!!  I am very afraid to reinstall SUPERANTISPYWARE....is this problem fixed????????  Please respond if you know.}

[SAS Malware Research]

The PostgreSQL detection issue was fixed within hours of the false positive report.