Archive: McAfee DAT 4629 falsely detect NSIS installers
McAfee DAT 4629 falsely detect NSIS installers
One of our clients made us raise an eyebrow saying that their virus scanner found a virus in our installers/uninstallers all of a sudden. This appears to be a problem with DAT 4629 of McAfee. For more information about the virus detected, and the note on the DAT version, see :
http://us.mcafee.com/virusInfo/defau...virus_k=136998
DAT 4630 maybe ok again
What plugins do you use?
I use KillProcDll and had no problems with McAfee yet. I had 4628 and just upgraded to DAT 4630 (maybe skipping the "false positive" DAT). I just scanned NSIS directory (including KillProcDll) using 4630 and it was found to be "clean".
Only thing used is MUI - a template 'empty' script that doesn't do anything :) I couldn't even find a reference to anything 'Kill' in the PE, so I'm not sure where McAfee was getting it from.
Good to hear you've got 4630 already - I'll re-run my online scan on the sandbox computer and make sure that's updated as well. Thanks :)
4630 fixes this, right?
Correct 4630 no longest falsely detects NSIS installers/uninstallers as being an 'undesired program'
It still looks like it flags the nsSCM plugin as spyware though:
http://search.mcafee.com/search?q=ca...&oe=ISO-8859-1