cancel
Showing results for 
Search instead for 
Did you mean: 
sarras
Level 7

False Positives - not submittable to McAfee

First, sorry if this sounds a bit p.o.ed.

VirusScan 13.3 as part of my Multi-License Total Protection Subscription detects the mua-program "TheBat!.exe" as Virus (IRCBot) and removes it from the system. So, no more email... on any of those systems ...

After disabling VS (ouch) I contacted the support hotline via email (yes I had to reinstall for that). Was told to submit the file via WebImmune. Went there, registered, and COULDN'T submit, because thebat!.exe is 6.43MB, ...

Wrote to Support again using the ticket number, got no answer ...

Tried to submit the program as attachment with email to Virus_Research@avertlabs.com, no reaction at all.

On this forum I found the info, that tose email submittals have to be zipped and less then 3MB als well! First, there is no such info an the Webimmune pages! Seconndm zipped it's still 6.3MB ...

So what the hell am I supposed to to?!
0 Kudos
7 Replies
exbrit
Level 21

RE: False Positives - not submittable to McAfee

If it's bigger than 3mb zipped they wont accept it. So the alternative is to submit it via the Security Center interface itself.

Double-click the taskbar icon to open Security Center
Click Advanced Menu (bottom left)
Click Restore (left)
Click either of the choices at top left to find the quarantined item and select the option to submit it to Avert.

If that program's manufacturers are made aware of it then they will contact McAfee at a corporate level and get it fixed.

It's unfortunate when this happens but it's not confined to McAfee, I've seen it happen with any of the anti-virus applications on the market.

I put forward a suggestion some time ago that Avert should start accepting larger files but it went nowhere unfortunately.

The other way would be to split the files into smaller entities for submission, if possible. Or if you could isolate whatever part of the programme is causing the alert and just forward that part.
0 Kudos
sarras
Level 7

RE: False Positives - not submittable to McAfee



AVERT doesn't seem to accept split files. At least there's no info on there site on that ...
0 Kudos
exbrit
Level 21

RE: False Positives - not submittable to McAfee

Sorry, I was hoping it was quarantining it.

Then contact the program's makers and have them contact McAfee at a Corporate level.

Meanwhile I'll flag this for attention, but as it's the weekend I doubt there's much that can be done until Monday.
0 Kudos
exbrit
Level 21

RE: False Positives - not submittable to McAfee

By the way I'm not familiar with the term MUA-PROGRAM but I'm assuming you mean TheBat! email application?
0 Kudos
exbrit
Level 21

RE: False Positives - not submittable to McAfee

DAT 5623 should have taken care of this detection. Can you tell me if it's OK now please?
0 Kudos
sarras
Level 7

RE: False Positives - not submittable to McAfee


Can't tell if everything's OK now. But I just started all SCAN-options again and so far the Bat is running without getting killed for 15 Minutes....
Smiley Tongue

Thanks for the help.
0 Kudos
exbrit
Level 21

RE: False Positives - not submittable to McAfee

It looks like it's been taken care of then. Can I mark this solved or not?
0 Kudos