I have been in contact with Kaspersky regarding the false positive detections. They have been quite helpful. I still need to find out what they are whitelisting, just the FreenetInstaller-1355.exe or the underlying files.
---------- Forwarded message ---------- From: <[email protected]> Date: Mon, Mar 14, 2011 at 10:37 PM Subject: RE: Re: [VirLabSRF][False alarm on a file][M:1][LN:EN][L:0] [KLAN-117070913] [KLAN-118829548] To: [email protected] Hello, It was added to the whitelist. Detection will disappear within 6 hours. Please quote all when answering. ----------------- Regards, Baranov Artiom Virus Analyst, Kaspersky Lab. >From: [email protected] >Sent: 15.03.2011 5:28:00 >To: "New Virus" <[email protected]> >Subject: Re: [VirLabSRF][False alarm on a file][M:1][LN:EN][L:0] >[KLAN-117070913] > > On Fri, Mar 4, 2011 at 5:58 AM, <[email protected]> wrote: > > Hello, > > > > We can not reproduce the detection, could you send us a screen shot about > > the detection ? > > > > Regards, > > VirusLab China > > > >>From: [email protected] > >>Sent: 03.03.2011 6:02:00 > >>To: "New Virus" <[email protected]> > >>Subject: [VirLabSRF][False alarm on a file][M:1][LN:EN][L:0] > >> > >> > >> LANG: en > >> email: [email protected] > >> > >> description: > >> Kaspersky Anti Virus 11.0.1.400 detects Freenet as PDM.Worm.P2P.generic > >> Freenet is P2P software promoting freedom of speech in oppressive > >> countries such as we are seeing in the Middle East now. > >> > >> To reproduce: > >> Install http://freenet.googlecode.com/files/FreenetInstaller-1355.exe from > >> http://freenetproject.org/index.html. Half way through the install > >> Kaspersky stops it and quarantines the installer. > >> > >> I have heard of other users having a similar problem, but encountered this > >> personally. > >> > >> I have attached the file. Note the file passes virus scan before the > >> install is attempted. > >> > >> uploaded files: > >> FREENETINSTALLER-1355.zip > > Sorry, to reply so late, I was on vacation. I am attaching two > screenshots. The "Freenet_Install_Start.jpg" shows the install > beginning just fine, the second screenshot > "FreenetInstaller_AV_Flagged.jpg" is when the install is continued and > files are unpacked. > It is not until the files are unpacked all the way and some other > programs/scripts inside are run that Kaspersky sees it as a virus. > > Thank you for looking further into this. Please keep me advised and > let me know if I can help in any way. > 10/1, 1st Volokolamsky Proezd, Moscow, 123060, Russia Tel./Fax: + 7 (495) 797 8700 http://www.kaspersky.com http://www.viruslist.com -- I may disagree with what you have to say, but I shall defend, to the death, your right to say it. - Voltaire Those who would give up Liberty, to purchase temporary Safety, deserve neither Liberty nor Safety. - Ben Franklin _______________________________________________ Devl mailing list [email protected] http://freenetproject.org/cgi-bin/mailman/listinfo/devl
