Browse by Tags

Re: null session and autorun update false positive findings

I have 163 for the Null Session. This one seems to be related to case sensitivity in the registry. Even if the settings are correct it is a finding unless the registry entries are in the proper (per Retina) CamelCasing. All lower case and it's a false positive. Is there any way to turn off case sensitivity...

Posted to Vulnerability Assessment (Forum) by spd5205 on 09-11-2009
MS09-035 installed but showing up as failure in Retina/REM

I'm trying to find out why MS09-035 is showing up as a failure because I've updated the system with the proper patch. The tested values retina gives are: CMP, C, ECL, MS09_035_VCPP2008_REDIST I don't recognize where retina is actually looking, can anyone tell me what these values mean? I've...

Posted to Vulnerability Assessment (Forum) by Lola on 08-04-2009
Re: Legit Detections or False Positives?

I would recommend making a copy of the files that you think are false-positives, zip them with the password infected. Be sure to include a link to your post here so someone can respond if need be. Email this to malware@eeye.com. eEye will have to send them to Norman so they can be corrected for you.

Posted to Troubleshooting (Forum) by Blue1978 on 06-14-2009
Re: False positive? - SSPro in duzactx.dll

Thanks - I've already done that, except that I didn't include a link to my post. However, I did use the same subject line, and the message was almost identical - will that do?

Posted to Troubleshooting (Forum) by Philip Gardner on 01-25-2009
Re: False positive? - SSPro in duzactx.dll

Send the "duzactx.dll", in a zip file with the password "infected", to malware@eeye.com . Be sure to include a link to this post. They should be able to send the file to Norman to have the false-positive addressed.

Posted to Troubleshooting (Forum) by Blue1978 on 01-24-2009
False positive? - SSPro in duzactx.dll

I have recently installed the Finance Coordinator program from Data Developments, and Blink Personal has detected malware SSPro in C:\Program Files\Data Developments\Finance\duzactx.dll.I hope this is a false positive - can you please confirm? Thanks!

Posted to Troubleshooting (Forum) by Philip Gardner on 01-24-2009
Re: Remedy for vulnerability items, “Microsoft Visual Basic 6.0 ActiveX Runtimes Code Execution (932349)”?

[quote]I'm running Server 2003 with all the latest service packs and updates. Please tell me someone is tracking this down because I also have about thirty more similar findings on my XP workstations. Is this a false positive? If not, what can I download/install to get rid of all these supposed errors...

Posted to Vulnerability Assessment (Forum) by nomuus on 01-23-2009
Re: Retina false positives

[quote user="Jarvis"] CVE-2008-1544, CVE-2008-1442 / BID 28379, 29556 - This was replaced by MS08-045 / KB953838[/quote] I have a ticket with eEye open on this one. I was told it was corrected with audit revision 1944, however, I am still showing it even after installing the patch: Name: IE7...

Posted to Vulnerability Assessment (Forum) by Blue1978 on 08-14-2008
False Positive Goldwave unstall.exe

The lattest version of the Blink AV is picking up Goldwaves unstall.exe as a false positive. The virus signture it is being taged with is W32/Banload.AGAR. This a global issue with many anti virus engines, as explained on the goldwave forums; http://goldwave.ca/forums/viewtopic.php?p=10315 ""...

Posted to General Discussion (Forum) by amckern on 06-10-2008
Possible Norman AV False-Positive (Pidgen Portable)

I may have found a false-positive with the portable version of "Pidgen" from http://portableapps.com. I have submitted the following trouble ticket for follow-up. Ticket ID: TK031307 Created On: 5/10/2008 7:02:06 PM --------------------------------------------------------------------------...

Posted to Blink 4.0 Feedback (Forum) by Blue1978 on 05-12-2008

Page 1 of 3 (23 items) 1 2 3 Next >