Help - Search - Members - Calendar
Full Version: Trojan Horse in keyfinder
UBCD4Win Forums > Main Forum: UBCD4Windows - Support > General Questions
drdane
AVG found a PSW.Generic6.DNL Trojan Horse in this file:
UBCD4Win\Plugin\Systeminfo\information\keyfinder

Just thought you should know, since it is apparently part of the build.

Dane
rdsok
As usual, this is a false positive being made by your antivirus program. This often happens with many antivirus programs and the main cause is from the fact that the malware authors are also using the very same compilers and file libraries of code that normal programs use so when a new malware detection is added to the antivirus definition files... it can have enough common code with normal programs that the normal program gets misdetected as a malware threat.

There is little that we can do about these detections except try and educate the users a bit and provide a bit of info to help support our statements.

I'll start by using a third party confirmation for what we state that UBCD4Win has been tested by Softpedia and was awarded a 100% Clean Award as can be verified on their website here http://www.softpedia.com/progClean/UBCD4WIN-Clean-76994.html

Since each time this happens its with a different program or detected as different threats we've can only address them in general. So we also got some info about these in the FAQ's here http://www.ubcd4win.com/faq.htm#false

Before you do anything else... update your antivirus or other protection program and test the file again. Most of the companies will update their definitions often and may have already corrected the issue... so always test with the latest updates before you do anything else.

We can also tell you how to double check all of the above by doing additional testing. Before you even run anything in the project... disable your On Access scanner for your protection program and then test the file or files in question at either http://virusscan.jotti.org/ or at http://www.virustotal.com . If you don't disable your protection you won't be able to upload the file because your protection software will block access to it.

Once you have tested and proven to yourself that it truely is a false positive... report the detection to your antivirus program's company so they can correct the issue. Don't get mad at them and switch for this type of reason alone... you would only switch one set of false detections for another that another program would have... so work with the company directly to get the issue resolved and you will help all users of the antivirus program.

If they want you to email them a copy of the file being detected... remember to archive the file ( arc, cab, tar, zip etc ) using a password and then send the archive file, tell them the password and tell them what it is being reported as along with any other info they may request.

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
Invision Power Board © 2001-2008 Invision Power Services, Inc.