7 Replies Latest reply on Oct 29, 2009 2:30 PM by Peter M

    False Positive on Plant Tycoon

      My wife's laptop is running McAfee Security Center 9.15. Beginning this morning, it began consistently detecting the game Plant Tycoon as a virus and placing it in quarantine. I can manually remove it from quarantine, but every time the game is run, it is detected again as a virus and placed again in quarantine.

      I am not having much luck figuring out how to place the program on the Trusted List. I see some indications on this forum that the ability to place programs on the Trusted List has been removed from certain older versions of McAfee, and that the only way to prevent McAfee from repeatedly detecting false positives is to email the file to McAfee, and obtain a custom DAT file, in McAfee agrees that the program is not a virus.

      Are these indications correct? Is there any way to add Plant Tycoon to the trusted list in McAfee 9.15?


      --Brett Turner
        • 1. RE: False Positive on Plant Tycoon
          Peter M
          Unfortunately, despite our lobbying for an expanded exception list, one can only tell VirusScan to ignore possibly unwanted programs, PUP's. Anything labelled worse than that can't be ignored.

          However there are things you can do to hopefully get an exception made.

          See: http://community.mcafee.com/showthread.php?t=233662
          • 2. RE: False Positive on Plant Tycoon
            Ex_Brit, thanks for your help.

            If I am reading the page you link to correctly, "things you can do to hopefully get an exception made" means emailing the file to McAfee?


            --Brett Turner
            • 3. RE: False Positive on Plant Tycoon
              Peter M
              Yes, zipped and password protected.
              • 4. Thanks Again
                This is a surprising, almost stunning problem with McAfee's user interface. Emailing the file to McAfee is not a solution---the user is left feeling like he or she must apply to McAfee for permission to use a file which McAfee thinks is a virus! I have verified that a competing product (ZoneAlarm) allows the user to override a false positive without all this hassle, and have decided to switch to that product.

                I mention this not out of anger, but because if a customer dropped one of my products due to glaring problem with the user interface, I would want to know.

                Ex_Brit, thank you again for your help, it was very useful in confirming the nature of the problem.
                • 5. RE: Thanks Again
                  Peter M
                  This practice isn't confined to McAfee. It's common to all anti-virus and many anti-spyware applications.

                  In this day and age where infections and malware generally are spewing out at the rate of 100's, even 1000's per day, it isn't surprising that you will encounter this from time to time. The writers of protection software obviously prefer to err on the side of caution than let something questionable through.
                  • 6. RE: Thanks Again
                    It's not that uncommon. Norton lets the user exclude a file from a scan. (I have it on my desktop and just checked). So does Zonealarm. Shouldn't the paying customer have the right to override a heuristics-based decision as to what constitutes a virus? The number of threads on this board about false positives is a pretty good indication that McAfee's decision isn't always right.

                    Users can vote with their dollars, I guess.
                    • 7. RE: Thanks Again
                      Peter M
                      Well, it used to be a feature and we have demanded they return it to the home product. It's still part of the Enterprise products.