False Positive with Beast (RAT)/ImagePak

[Terry Rasmussen]

I am receiving a false positive for a severe threat
called Beast (RAT). The detected locations for this
threat are as follows:

HKEY_CLASSES_ROOT\.bad
HKEY_CLASSES_ROOT\.bad ImagePak.badfile
HKEY_CLASSES_ROOT\.bad Content Type text/ImagePak

These registry entries actually belong to an application
called ImagePak which is written and distributed by a
company called Herff Jones. I know this because I am the
current developer responsible for this application.
ImagePak makes these entries in order to register a file
with a BAD extension that it utilizes.

I'd appreciate this false positive being corrected.

Thanks!

ImagePak's webite: http://www.herffjones.com/imagepak/

 

[Bill Sanderson]

Terry - here's a direct web form for reporting of false postives by vendors:
http://www.spynet.com/falsepositive.aspx

And, FWIW, here's also the KB article giving criteria for inclusion by the
program, and the form for dispute by vendors of such inclusion.

http://support.microsoft.com/kb/892340 Microsoft Windows AntiSpyware (Beta)
identifies a program as a spyware threat (Listing criteria and Dispute
process)

http://www.spynet.com/vendors.aspx

 

[Terry Rasmussen]

Thank you, Bill! I'll fill out the false positive report
immediately.

Terry

 

[Bill Sanderson]

I hope that process goes well. If you think of it, posting back here about
your experience may accomplish several goals: 1) it may encourage (or
discourage!) other developers facing similar issues, and 2) it may give some
feedback to the beta management about how their process is going, from the
perspective of the development community.
--
FAQ for MS AntiSpy http://www.geocities.com/marfer_mvp/FAQ_MSantispy.txt

Thank you, Bill! I'll fill out the false positive report
immediately.

Terry