4 Replies Latest reply on Feb 21, 2011 8:29 AM by pol555

    False Positive

      I have a Seagate external drive with Replica software on it ,I keep getting a false positive from my Mcafee virus scan as a  Trojan, the file is Exploit-ScriptNull.

      I have seen on the Internet that others are having the same problem.I would like to tell my virus scan to trust this file but I don't seem to have that option.It automatically quarantines it for me .When will the software allow me the choice of   warning me of issues and letting me dictate the response instead of arbitrarily taking action without my direct input. I Believe the old version allowed me that choice? What can I do besides turning off my Mcafee real time virus scan?

        • 1. Re: False Positive

          Hi Pol555,


          Email file to: virus_research@mcafee.com


          When submitting samples via E-mail all samples must be packaged in a .ZIP file and email header should start with the word "False" (minus the "").

          Additionally, any .ZIP file created must be password-protected using the password "infected" (minus the ""). Failure to follow these guidelines will cause your submission to be rejected.

          If you've done that properly an automated response should be received almost immediately, followed by a manual one, usually within 24 - 48 hours.

          If you don't receive anything it either means the file was submitted incorrectly or the response is sitting in your Junk or Spam mail folders.


          **If they respond that it is an infection and you are sure it is not, forward* that email immediately to virus_research@mcafee.com and insert the word'False' (minus the '') in front of the header, but keep the rest of the header intact.

          *recommending you use forward because at the moment if you hit reply it goes to the old avertlabs.com email address in error due to a programming error in McAfee's servers.





          • 2. False Positive

            I can't do that because the smallest file even after being zipped is still 34mb and they only accept a file smaller than 3mb

            • 3. False Positive

              Hi pol555,

              Create an account under https://www.webimmune.net/default.asp and there you will get an option to browse the sample that need to be submitted to McAfee Labs.

              1 of 1 people found this helpful
              • 4. False Positive

                Thank you  I took just the file inside the folder and was able to send it off.