1 Reply Latest reply on Jun 19, 2008 8:47 PM by Grif

    Unwanted Program that is really wanted.

      VSE 8.5P5

      I have a critical enterprise application - home grown by our development staff - that McAfee deletes because it believes it is an unwanted program. Yes exclusion prevents this but in a few months the application will get moved to another server or a test environment will be brought up and we'll forget about the a/v setting and the executible file will get deleted again causing pain and grief mostly to me.

      So... McAfee must see this file as matching some unwanted programs signature. I tried a name change (for grins) but Virus Scan was smarter then this.

      Is there anything I could have my developers do when they create the application that would prevent it being identified as an unwanted program or not match an existing signature? The program needs to present a different signature.
        • 1. RE: Unwanted Program that is really wanted.
          Although you might be able to send the file to Avert so they can check it, since the program is "home grown" and a one-of-a-kind thing, I doubt they will fix the virus definitions to skip your program only. Still, it might be worth a try at the link below.

          http://vil.nai.com/vil/submit-sample.aspx

          I can see their side of things.. You have a customer asking: "How can I make my virus not show up as a virus in your scanner?" Since the scanner is probably detecting something within the program which is used in other malware, I don't think you'll get their approval to remove that detection. Every virus writer in the world would like to have that information...

          In your situation, we simply set up the program as an Exclusion in McAfee.

          Hope this helps.

          Grif