OT: SASW FP

[Tim Clark]

I have reported a false positive to the people at superantispyware.
It involves a file used by Universal Extractor, a common geek tool that I
thought some people in this group could be users of [It takes the files out
of an installer package/program with out installing the program itself]

Below is the report. As I am not a great fan of SASW I'm hoping it will be
enough. I really do not want to get into back and forth emails and sending
of files. I used the report FP function of the program but it did not show
me if it was going to send anything other than what I actually typed.

What I typed:
The detected file peid.exe is detected as Trojan.Unclassified/Packed-Win It
is a component of Universal Extractor, a popular "geek" tool.
It was not detected by SASW before yesterdays update. I have had it on my
machine for over a year. It is not detected by any of my other malware
checking tools, Windows Defender, AdAware, Spybot S&D, McAfee, Avast,
YahooAnti Spy, XoftSpy, etc

What I saw from the program log (which I don't know if it was sent [boy
that's bad English!)]

SUPERAntiSpyware Scan Log
Generated 12/01/2007 at 01:34 PM

Application Version : 3.5.1016

Core Rules Database Version : 3353
Trace Rules Database Version: 1352

Scan type : Custom Scan
Total Scan Time : 00:01:02

Memory items scanned : 373
Memory threats detected : 0
Registry items scanned : 0
Registry threats detected : 0
File items scanned : 108
File threats detected : 1

Trojan.Unclassified/Packed-Win
C:\DOCUMENTS AND SETTINGS\TIM\MY
DOCUMENTS\TEMP\DOWNLOADED\EMERGENCYSTUFF\UNIEXTRACT142_NOINST\BIN\PEID.EXE

 

[Bill Sanderson]

I can remember a number of similar False Positives during the early stages
of the Windows Defender beta. Sophisticated malware requires software tools
and installers like any program, and the malware writers tend to use the
open source stuff that is easily available and free.

What is required. I suspect, is that the vendor of the definitions/program
(i.e. sasw) create a list of "known good" files, so that they can make sure
that they look beyond that innocent file to other files which will be
characteristic of malware, and not finger the development or installer tool
itself.

This stuff is getting harder to pin down--with a tool like that involved,
there was an archive, and that tool extracted stuff from it, but from there
on out it may be hidden by a rootkit. I'm sure this process is not easy.