Is this a false positive or bug with IE 6, McAfee 8/9/10 or both IE 6 and McAfee?

Discussion in 'Virus Information' started by GG, Jun 26, 2006.

  1. GG

    GG Guest

    I get this error on two machines with IE6 and McAfee
    When going to http://starwarsspoofs.com/, McAfee reports a problem.
    Anyone else using Mcafee 8, 9 or 10 and have this same problem?
    I get a Generic Downloader.0 trojan found message.
    http://vil.nai.com/vil/content/v_131316.htm

    My McAfee specs:
    Mcafee Virusscan 10.0
    Build 10.0.27
    Engine version 4450
    Dat version 4792
    Dat file created 6/23/2006

    When using IE Mcafee reports a trojan.
    When using Firefox Mcafee doesn't.
    I guess it's just something funky between IE and Mcafee.

    Anyone else using McAfee 8, 9 or 10 and have dat file 4422 - 4769?
    If so, do you get this error?
    I've already done a McAfee full scan in normal and safe mode.
    McAfee says my pc is clean.

    I posted this info on McAfee's online forum.
    I'll be checking McAfee's and this thread daily.
    So, what is the cause of this problem?
    Is this problem a false positive?
    IE 6, McAfee 8/9/10 or http://starwarsspoofs.com/
    Any info is appreciated!

    http://webpages.charter.net/flashtv/stuff/starwarsspoofs1.JPG
     
    GG, Jun 26, 2006
    #1
    1. Advertisements

  2. From: "GG" <>

    | I get this error on two machines with IE6 and McAfee
    | When going to http://starwarsspoofs.com/, McAfee reports a problem.
    | Anyone else using Mcafee 8, 9 or 10 and have this same problem?
    | I get a Generic Downloader.0 trojan found message.
    | http://vil.nai.com/vil/content/v_131316.htm
    |
    | My McAfee specs:
    | Mcafee Virusscan 10.0
    | Build 10.0.27
    | Engine version 4450
    | Dat version 4792
    | Dat file created 6/23/2006
    |
    | When using IE Mcafee reports a trojan.
    | When using Firefox Mcafee doesn't.
    | I guess it's just something funky between IE and Mcafee.
    |
    | Anyone else using McAfee 8, 9 or 10 and have dat file 4422 - 4769?
    | If so, do you get this error?
    | I've already done a McAfee full scan in normal and safe mode.
    | McAfee says my pc is clean.
    |
    | I posted this info on McAfee's online forum.
    | I'll be checking McAfee's and this thread daily.
    | So, what is the cause of this problem?
    | Is this problem a false positive?
    | IE 6, McAfee 8/9/10 or http://starwarsspoofs.com/
    | Any info is appreciated!
    |
    | http://webpages.charter.net/flashtv/stuff/starwarsspoofs1.JPG
    |

    To start with, you Engine version is funky.
    The latest is v4400 (sans Beta 5000 which I use)

    Well my v7.1E also flags the HTML page.

    6/26/2006 1:08:25 PM Delete failed (Clean failed) DLIPMAN-1\lipman D:\temp\IE6\Temporary
    Internet Files\Content.IE5\4LUTYVAL\starwarsspoofs[1].htm Generic Downloader.o

    But... No other vendor does. I will submit it to McAfee as a False Positive

    AntiVir 6.35.0.16 06.26.2006 no virus found
    Authentium 4.93.8 06.23.2006 no virus found
    Avast 4.7.844.0 06.26.2006 no virus found
    AVG 386 06.26.2006 no virus found
    BitDefender 7.2 06.26.2006 no virus found
    CAT-QuickHeal 8.00 06.26.2006 no virus found
    ClamAV devel-20060426 06.26.2006 no virus found
    DrWeb 4.33 06.26.2006 no virus found
    eTrust-InoculateIT 23.72.49 06.25.2006 no virus found
    eTrust-Vet 12.6.2275 06.26.2006 no virus found
    Ewido 3.5 06.26.2006 no virus found
    Fortinet 2.77.0.0 06.26.2006 no virus found
    F-Prot 3.16f 06.23.2006 no virus found
    Ikarus 0.2.65.0 06.26.2006 no virus found
    Kaspersky 4.0.2.24 06.26.2006 no virus found
    McAfee 4793 06.26.2006 Generic Downloader.o
    Microsoft 1.1481 06.25.2006 no virus found
    NOD32v2 1.1625 06.26.2006 no virus found
    Norman 5.90.21 06.26.2006 no virus found
    Panda 9.0.0.4 06.26.2006 no virus found
    Sophos 4.07.0 06.26.2006 no virus found
    Symantec 8.0 06.26.2006 no virus found
    TheHacker 5.9.8.165 06.26.2006 no virus found
    UNA 1.83 06.26.2006 no virus found
    VBA32 3.11.0 06.26.2006 no virus found
    VirusBuster 4.3.7:9 06.25.2006 no virus found
     
    David H. Lipman, Jun 26, 2006
    #2
    1. Advertisements

  3. GG

    GG Guest

    Thx.
    I posted this info to McAfee's website and emailed them the .htm file
    yesterday.
    Both McAfee and you agree that it's a false positive.
    Thx for your input!
     
    GG, Jun 26, 2006
    #3
  4. From: "GG" <>

    | Thx.
    | I posted this info to McAfee's website and emailed them the .htm file
    | yesterday.
    | Both McAfee and you agree that it's a false positive.
    | Thx for your input!

    Still not corrected though by DAT v4793 :-(
     
    David H. Lipman, Jun 26, 2006
    #4
  5. GG

    GG Guest

    Check this out.
    I uninstalled and reinstalled McAfee.
    I now have engine 4400 back.
    I've seen other people mention 4450 also.
    Who knows why certain people get 44550 vs 4400.
    After reinstalling, I no longer get the error with engine 4400.
    Here are my specs after reinstalling:

    My McAfee specs:
    Mcafee Virusscan 10.0
    Build 10.0.21
    Engine version 4400
    Dat version 4793
    Dat file created 6/26/2006

    These were my original specs:
    My McAfee specs:
    Mcafee Virusscan 10.0
    Build 10.0.27
    Engine version 4450
    Dat version 4792
    Dat file created 6/23/2006

    I have one more machine with engine 4450.
    I'll check it in about two months to see if it gets a new engine.
    If not, I'll reinstall McAfee on it.
    I wonder if you uninstalled Mcafee enterprise 8 on your machine and had
    another engine besides the beta one would you still get the same error?

    Here are some users with engine 4450.
    http://forums.mcafeehelp.com/viewtopic.php?t=58983
    http://forums.mcafeehelp.com/viewtopic.php?t=57645

    It appears that anyone with engine 4450 gets build 10.0.27.
    I wonder if I'll get 4450 back again when my machine is auto updated?
     
    GG, Jun 27, 2006
    #5
  6. From: "GG" <>

    | Check this out.
    | I uninstalled and reinstalled McAfee.
    | I now have engine 4400 back.
    | I've seen other people mention 4450 also.
    | Who knows why certain people get 44550 vs 4400.
    | After reinstalling, I no longer get the error with engine 4400.
    | Here are my specs after reinstalling:
    |
    | My McAfee specs:
    | Mcafee Virusscan 10.0
    | Build 10.0.21
    | Engine version 4400
    | Dat version 4793
    | Dat file created 6/26/2006
    |
    | These were my original specs:
    | My McAfee specs:
    | Mcafee Virusscan 10.0
    | Build 10.0.27
    | Engine version 4450
    | Dat version 4792
    | Dat file created 6/23/2006
    |
    | I have one more machine with engine 4450.
    | I'll check it in about two months to see if it gets a new engine.
    | If not, I'll reinstall McAfee on it.
    | I wonder if you uninstalled Mcafee enterprise 8 on your machine and had
    | another engine besides the beta one would you still get the same error?
    |
    | Here are some users with engine 4450.
    | http://forums.mcafeehelp.com/viewtopic.php?t=58983
    | http://forums.mcafeehelp.com/viewtopic.php?t=57645
    |
    | It appears that anyone with engine 4450 gets build 10.0.27.
    | I wonder if I'll get 4450 back again when my machine is auto updated?
    |
    ]

    Detection is in the signature not the Engine. I'll have to do some research on Engine v4450
    and what this version is about. The standard SuperDAT deploys Engine v4400 and the latest
    DAT. The Engine only SuperDAT provides v4400. I use v5000 Beta. I am using McAfee
    Enterprise VirusScan v7.1E. That's a corporate version and not a retail version like you
    are using.
     
    David H. Lipman, Jun 27, 2006
    #6
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.