possibly false artemis A650C6722237

[giraff]

We recently got a lot of support because a third party software called nircmdc.exe from NirSoft got classifled as a Trojan (Artemis!A650C6722237) by McAfee virus scans. Worse it seems McAfee in some cases silently quaranteens nircmdc.exe making our software fail.

We have used this software in our product for several years so I'm pretty sure it is safe, but I'll leave that call to the experts.

Please look into this as soon as possible as it is costing us time and money and our customers (elderly care) stress and discomfort!

[showvik]

Hi,

Artemis!A650C6722237 is now detected as Potentially Unwanted Program, ToolNirCmd. It does not contain a virus, and is not considered a trojan in itself because it does not damage systems maliciously. However, it may be used for assisting malicious activities in conjuction with a malware.

If this is being used for a known good cause internally, please use the product exclusions to whitelist this application locally.

Please refer <http://home.mcafee.com/VirusInfo> for technical information.

Regards,

Showvik

[Peacekeeper]

Showvik if this user has consumer he cannot whitelist so realtime scanner does not detect it. I assume enterprise can do that.

Ah thanks I see now you allow it when detected and that trusts it. This is what I get having too clean a system i do not see these warnings.

Message was edited by: Peacekeeper on 14/09/12 8:14:23 AM

[showvik]

Hi,

The following information on PUP configuration should help:

<http://www.mcafee.com/us/mcafee-labs/resources/pups-configuration.aspx>

Regards,

Showvik

[giraff]

showvik: Thanks for dealing with this swiftly!

Peacekeeper: You are correct.

Part of our system is a client that can (intended distribution) be downloaded to and installed on any Windows computer. Most of the client users work in healthcare organizations where the people actually using the software are not required to be skilled with computers. In almost all cases they do not have administrative previleges.

The important thing for us is that nircmdc.exe does not get removed or disabled by McAfee as this may shut down the service we provide. Getting warnings is manageble.