Bits from Bill
Do All Signatures Come From Kaspersky?
You might think there exists a huge number of anti-malware programs out there. If so, you’d be right but you might be surprised to find out how many use the same anti-virus engine and signature files.
My mailbox was flooded yesterday with a number of freaked out WinPatrol users who had our software removed by Kaspersky Internet Security Suite. It seems Kaspersky was identifying WinPatrol as “pornware not-a-virus:Porn-Dialer.Win32.Agent.aw“.I was pleased that most folks knew this must be some kind of false-positive error, but I also had my share of users in a panic blaming me for infecting their systems.
By evening, I did hear back from Kaspersky Virus Analyst, Yury Nesmachny who apologized and said,According to tests today with VirusTotal.com, Kaspersky has corrected this error.“Sorry, it's false alarm. Its detection will be deleted in the next update. Thank you for your help.”
I had created a standard reply for Kaspersky users but as the day continued it got worse. Apparently, a significant number of other products use signature files from Kaspersky for their products.
This isn’t the first time this error has occurred. Last December Panda Software tried to tell users WinPatrol was a porn dialer. Panda was pretty responsive and I appreciate the quick action from Kaspersky which hopefully, will be deployed quickly to all their partners. I’ve also been told WinPatrol isn’t alone. AdobeUpdaterInstallMgr, Quicken and many other popular applications were mis-identified.
Update: Thanks to Don Pelotas who pointed me to this list of Kaspersky partners.
http://www.kaspersky.com/oemsuccess
Labels: false-positive, Kaspersky, pornware
posted by Unknown | 12:33 PM
5 Comments:
I have the same problem with AVG. It identifies a telephone dialer virus linked to WinPatrol.
I got the Zone-alarm error too. Glad I came to read your blog before emailing you as well *g*
F-Secure is tagging my WinPatrol as a porn dialer also. The only way I could get through a complete scan was to remove WinPatrol.
F-Secure has been been responsive. Their reply to my Scan Report says they are aware an issue associated with WinPatrol and they are investigating it.
I hope they figure it out really soon.
Thanks Bill.
People out there who have been using WIN PATROL for a while you should have realized that Win Patrol is not a virus.
If Bill P. was that devious to cause you to get a virus from his Win Patrol program he would not have his name address + Ph # on his site.
This is a classic chain reaction on programs. Use good judgment but when an apps does its job right for so many years you got to have doubt its gone bad.
Keep up the good work!
That figures.
Its times like this I am glad I still use the old free version of Sygate Personal Firewall and NOD 32 for my Antivirus program.
But I need to thank you for the great suggestion of moving away from Norton as my antivirus. NOD 32 runs so much better with less memory usage.
Post a Comment
<< Home