F-Prot False Positve Alerts on AVG archive/.exe

  • Thread starter Thread starter Rick M.
  • Start date Start date
R

Rick M.

Hi,

I just ran into a problem similar to a problem F-Prot had just a
couple of weeks ago w/regard to Sun Java files.

F-StopW.exe (F-Prot's RealTime Scanning engine) keeps alerting on my
"avg70free_296a409.exe" file and saying it is a security risk named
"W32/Backdoor.Kl"

I run both AVG Free v7.0 and F-Prot, and have never experienced a
problem with this configuration before. In fact, I find the two
programs are rather complimentary.

This alert, however, is suspicious in that it keeps flagging the AVG
archive which (just to be certain) I then deleted, and re-downloaded
directly from AVG's download page again, yet it stll flags the file as
infected.

Considering this alert is remarkably similar to the problem F-Prot had
just a few weeks ago flagging Sun Java files in the
j2re-1_4_204-windows-i586-p.exe file, I have to think that this is a
problem with F-Prot's FStop-W component, and is actually a false
positive alert.

Has anyone else using these two anti-virii programs encountered this?


-Rick
 
Rick said:
Hi,

I just ran into a problem similar to a problem F-Prot had just a
Click to expand...

I forgot to mention that the version of F-Prot I'm encountering this
problem is v3.15b, with a sign.def file date 12/9/04 and a macro.def
file dated 12/6/04.

-Rick
 
Marc said:
Just another reason why you should not have multiple AV's on your desktop...

Marc
Click to expand...

Well, I don't know if I would make that general assertion. Remember,
the problem I described was not an *interaction* problem between two
active antivirii, but rather that one antivirus program was false
alerting on the _presence_ of the _installer_ _archive/executable_ of
another installed antivirus. This was *not* a case of two active
antivirii scanning engines 'bumping heads'.

Furthermore, I emailed a report of this to F-Prot technical support at
9:15AM this morning just before I posted the starting message of this
thread, and got a response back from F-Prot technical support by 2:13PM
confirming that this problem was indeed a false positive. Their latest
virus signature files (dated as of today) have fixed the problem.

My experience with using AVG and F-Prot has been very good, and the two
provide better detection coverage than, say, Norton alone does, and at a
resource utilization level that is considerably less than Norton alone.
I would agree you have to be careful as to which antivirii you choose
to install when using more than one, particularly with the real-time
scanning engine components. In the case of F-Prot and AVG, however,
they've always coexisted rather nicely on my systems. F-Prot seems to
have the better realtime scanner of the two (although AVG's is very good
too) but F-Prot doesn't have email attachment scanning whereas AVG does,
along with a true 'quarantine' function.


-Rick
 
Back
Top