How to report False Positive to us?

[Lora316K]

IObit Security 360

 

OS:Windows XP

Version:0.2.1.75

Define Version:1069

Time:7/20/2009 12:01:04 PM

 

|Name|Type|Description|ID|

Adware.Ezula, File, C:\WINDOWS\system32\mnmsrvc.exe, 10-13951

[SJSF]

I believe this are false positives.You can find GSA Security here, http://www.softpedia.com/get/Antivirus/Cobra-Security-2010.shtml

[danburrito]

HijackThis FP

 

IObit Security 360

OS:Windows Vista

Version:0.2.1.75

Define Version:1073

Time:7/20/2009 5:40:32 PM

|Name|Type|Description|ID|

Adware.Cax, File, D:\_Disk A\Virus, Spyware & Security\HijackThis v2.0.2.exe, 9-57678

[evilfantasy]

IObit Security 360

 

Adware.Cax, File, D:\_Disk A\Virus, Spyware & Security\HijackThis v2.0.2.exe, 9-57678

 

Confirmed.

 

IObit Security 360

 

OS:Windows XP

Version:0.2.1.75

Define Version:1071

Time:2009-07-20 06:36:05 PM

 

|Name|Type|Description|ID|

Adware.Cax, File, C:\Program Files\Trend Micro\hijackthis.exe, 10-12283

[danburrito]

IObit Security 360

OS:Windows Vista

Version:0.2.1.75

Define Version:1073

Time:7/20/2009 5:40:32 PM

|Name|Type|Description|ID|

Adware.Cax, File, D:\_Disk A\Virus, Spyware & Security\HijackThis v2.0.2.exe, 9-57678

 

Seems to be fixed with definitions version 1074.

 

Thanks, guys.

[jcheney]

Pretty sure my sys is clean...

 

IObit Security 360

 

OS:Windows 7 (x64)

Version:0.2.1.75

Define Version:1078

Time:7/22/2009 11:19:01 PM

 

|Name|Type|Description|ID|

Hijack.DisplayProperties, Registry Data, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer Value=NoActiveDesktopChanges, 6-521

 

--------------------

 

Here's the whole Registry Key:

 

Windows Registry Editor Version 5.00

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer]

"NoActiveDesktop"=dword:00000001

"NoActiveDesktopChanges"=dword:00000001

"ForceActiveDesktopOn"=dword:00000000

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]

 

------------------------

 

System is 3 weeks old, freshly installed with Windows 7 RC Build 7100 x64

I've used Panda ActiveScan and AVG Free with a command line AVG scan hitting my primary download folder every 5 hours.

 

Is activedesktop disabled in 7 by default via this key? Haven't really looked...

[enoskype]

Here is the registry entry for:

 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Policies\Explorer\Run

 

in Windows 7 RC 7229 installed yesterday.

 

Only IObit products + AVG Pro.

 

http://forums.iobit.com/attachment.php?attachmentid=1111&d=1248381671

 

 

Cheers.

[peksman143]

is it a fale positive?

 

Before reporting a false positive, please save a scan report first and post it here. This will help us know the detailed information about the scan result.

 

 

 

OS:Windows XP

Version:0.2.1.75

Define Version:1076

Time:7/24/2009 9:48:19 PM

 

|Name|Type|Description|ID|

Tracking Cookies, Cookies, Cookie:levi@ad.yieldmanager.com/, 7-1548

Misleading.WinDefender, Registry Key, HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\FwHookDrv, 4-1472

[bigjeff22]

False Positive - Logitech

 

IObit Security 360

 

OS:Windows XP

Version:0.2.1.75

Define Version:1081

Time:2009-07-24 20:40:21

 

|Name|Type|Description|ID|

 

Keylogger.Snipher, File, C:\Program Files\Logitech\QuickCamWebInstall\techsupt\MiscTools\MSIZap.exe, 9-64568

[yakuzu]

:shock:hi all.IObit Security 360 detects an aplication,"GetSystemInfo",as a trojan.crypt.xpack!this aplication ,when I run it,tells me about my softwares,hardwares and devices and if there are conflicts between them.its like your product "Software Informer". IObit Security 360 has no conflicts with my antivirus,Avira+Comodo suite,but it tells me my firewall is Avira instead Comodo!? I had Avira firewall,now I've,as I said,Comodo.

Have a nice day ! God bless you!:-D

[Harley]

Open office installer?

 

This has to be a FP!

[s1j2m3]

from Medion P6612 laptop

 

IObit Security 360

 

OS:Windows Vista

Version:0.2.2.8

Define Version:1092

Time:30/07/2009 11:03:15

 

|Name|Type|Description|ID|

Trojan.Crypt.XPACK, File, D:\TOOLS\MedionHomeCinema_R6\MShow\vcredist_x86.exe, 12-218

 

 

This file is in the back up drive needed to reset the laptop to factory default.

Is it really a trojan or just a information collector for Home Cinema

[Secmas]

Universal USB driver.

 

Could this be a false positive?

 

IObit Security 360

 

OS:Windows XP

Version:0.2.2.8

Define Version:1092

Time:2009-07-30 07:15:37 a.m.

 

|Name|Type|Description|ID|

Trojan.Crypt.XPACK, File, C:\Documents and Settings\Escritorio\Escritorio 1\nusb33es.exe, 12-218

 

I use BitDefender Total Security 2009 and it doesn't show it as a threat.

 

Regards.

[fr paul]

False negative report

 

I have found another false negative:- Here is the report

 

IObit Security 360

 

OS:Windows XP

Version:0.2.2.8

Define Version:1095

Time:31/07/2009 23:47:41

 

|Name|Type|Description|ID|

Backdoor.Bifrose, Folder, C:\WINDOWS\system32\win32.exe, 3-2836

Tracking Cookies, Cookies, Cookie:paul kronbergs@www.virginmedia.com/, 7-2203

Tracking Cookies, Cookies, Cookie:paul kronbergs@virginmedia.com/, 7-2203

Tracking Cookies, Cookies, Cookie:paul kronbergs@search.virginmedia.com/, 7-2203

[danburrito]

Win32.exe is definately not a Windows system file. Check it with http://www.virustotal.com and see what result it comes up with.

[enoskype]

Hi there,

 

Please have a look at THIS web page.

 

Cheers.

[pimpmypc]

IObit Security 360

 

OS:Windows XP

Version:0.2.2.8

Define Version:1098

Time:8/2/2009 2:25:19 AM

 

|Name|Type|Description|ID|

Trojan.Crypt.XPACK, File, C:\WINDOWS\ServicePackFiles\i386\aspnet_regiis.exe, 12-562

[enoskype]

Hi pimpmypc,

 

Please have a look at THIS post.

 

Cheers.

[DonnyD]

False Positives ????

 

IObit Security 360

 

OS:Windows XP

Version:0.2.2.8

Define Version:1098

Time:8/2/2009 9:27:00 AM

 

|Name|Type|Description|ID|

Disabled.SecurityCenter, Registry Data, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center Value=AntiVirusDisableNotify, 6-554

Disabled.SecurityCenter, Registry Data, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center Value=FirewallDisableNotify, 6-555

Disabled.SecurityCenter, Registry Data, HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center Value=UpdatesDisableNotify, 6-556

Trojan.Crypt.XPACK, File, C:\WINDOWS\$NtServicePackUninstall$\aspnet_regiis.exe, 12-562

Adware.Ascentive, File, C:\WINDOWS\system32\SysRestore.dll, 9-10303

Misleading.PCSpeedScan, File, C:\System Volume Information\_restore{6D3FBDEF-8C21-4647-9BF3-72176E328E86}\RP288\A0028526.exe, 9-4161

Adware.Ascentive, File, C:\System Volume Information\_restore{6D3FBDEF-8C21-4647-9BF3-72176E328E86}\RP288\A0028535.exe, 9-7388

Adware.Ascentive, File, C:\System Volume Information\_restore{6D3FBDEF-8C21-4647-9BF3-72176E328E86}\RP288\A0028536.exe, 9-7388

Trojan.Crypt.XPACK, File, C:\WINDOWS\ServicePackFiles\i386\aspnet_regiis.exe, 12-562

Trojan.Crypt.XPACK, File, C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\aspnet_regiis.exe, 12-562

[SYP Battlecommander]

IObit Security 360

 

OS:Windows XP

Version:0.2.2.8

Define Version:1098

Time:02.08.2009 17:25:35

 

|Name|Type|Description|ID|

Trojan.Crypt.XPACK, File, D:\Schutzprogramme\aspnet_regiis.exe, 12-562

 

 

aspnet_regiis.exe seems to be a false positive, it's part of Microsoft .NET Framework ...

 

Virustotal: http://www.virustotal.com/de/analisis/a050f47312ae7f6da78b564c1d8c0527166a0294cda24e6bbb783962a5b94036-1249227130

[danburrito]

Trojan.Crypt.XPACK, File, C:\WINDOWS\$NtServicePackUninstall$\aspnet_regiis.exe, 12-562

Trojan.Crypt.XPACK, File, C:\WINDOWS\ServicePackFiles\i386\aspnet_regiis.exe, 12-562

Trojan.Crypt.XPACK, File, C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\aspnet_regiis.exe, 12-562

 

Battlecommander;20920']Trojan.Crypt.XPACK' date=' File, D:\Schutzprogramme\aspnet_regiis.exe, 12-562[/quote']

 

Please read this thread.

[SYP Battlecommander]

Thanks danburrito ... my first malware since 2 years, Security 360 is doing a good job nor Avira or any other scanner actually can detect this one.

[mose]

False positive:

C:\windows\iun6002.exe

 

checked with VirusTotal

[leofelix]

F.P EasyBCD, detected as "Trojan.Agent"

 

IObit Security 360

 

OS:Windows XP

Versione:0.3.0.22

Define Version:1106

Time:07/08/2009 15.41.33

 

|Nome|Tipo|Descrizione|ID|

Trojan.Agent, File, C:\Documents and Settings\Administrator\Desktop\EasyBCD 1.7.2.exe, 12-1134

 

Virustotal:

 

http://www.virustotal.com/it/analisis/e5845ec298fbb0a6862acf2caa00d9bf68bda5b9a3bd521f350bcf422318e5e4-1249653121

 

 

SoftPedia:

 

http://www.softpedia.com/get/System/OS-Enhancements/EasyBCD.shtml

 

EasyBCD is an advanced GUI application that makes it easy to modify the Windows Vista bootloader and the entries in

 

 

Softpedia guarantees that EasyBCD 1.7.2 is 100% CLEAN, which means it does not contain any form of malware, including spyware, viruses, trojans and backdoors

 

More: MalwareBytes' AntiMalware didn't detect any kind of spyware/adware/trojan

 

I think is a false positive

[jerick70]

Hello,

 

I am getting this false possitive:

 

IObit Security 360

 

OS:Windows XP

Version:0.3.0.22

Define Version:1107

Time:8/7/2009 11:51:18 AM

 

|Name|Type|Description|ID|

Trojan.Agent, File, C:\WINDOWS\system32\wintab32.dll, 4-26783

 

This is for Wacom Tablets. It is installed by Adobe products. This particular install was by Adobe Pagemaker 7.

 

Here is a scan by virustotal.com:

 

http://www.virustotal.com/analisis/e30c63ce13945275766908c7b28639ee487efed90acbfa4c716c83018ab193a9-1248035270