dvdsanta and mccafee 9.1

[no one]

http://www.dvdsanta.com



I download it ( DEMO) and and scan the installation file with Mcafee
virus scan and it says it is Virus FREE, but if I run the
installation file It Stops the install telling me it is INFECTED with
W32/SDBOT.WORM.T

Something is Fishy here since the NON-DEMO I bought (11/24/04) from
DVDSANTA does the SAME thing!

I redownloaded the FULL version from the private link and it ALSO SAYS
it is infected .

This all started with mcafee updating my DAT files on 04/27/05
Even tho the Virus was first discovered in 2003

Mcafee is no help... Spent 2 hours in Chat with them !

 

[David H. Lipman]

From: "no one" <[email protected]>

|
| http://www.dvdsanta.com
|
| I download it ( DEMO) and and scan the installation file with Mcafee
| virus scan and it says it is Virus FREE, but if I run the
| installation file It Stops the install telling me it is INFECTED with
| W32/SDBOT.WORM.T
|
| Something is Fishy here since the NON-DEMO I bought (11/24/04) from
| DVDSANTA does the SAME thing!
|
| I redownloaded the FULL version from the private link and it ALSO SAYS
| it is infected .
|
| This all started with mcafee updating my DAT files on 04/27/05
| Even tho the Virus was first discovered in 2003
|
| Mcafee is no help... Spent 2 hours in Chat with them !

Is there one particular file that was flagged with the SDbot ?

 

[no one]

installation file is SETUP.EXE


I just tried to install it on another computer and the same thing
happens And That computer also is running the NEW DAT files from mcafee.

This is the ERROR while installing

C:\programfiles/dvdsanta/dvdsanta.exe

AN ERROR occured while trying to rename a file in the destination
directory : MOVIEFILE FAILED; CODE5.
ACCESS IS DENIED


Now if I disable MCAFEE DVDSANTA will install.. When I re-enable
Mcafee, Mcafee immediately DELETES DVDSANTA.EXE saying it is infected .
As I said originally.. Mcafee did the update and dvdsanta wasnot
even running and Mcafee immediately says DVDSANTA is infected and
DELETED the DVDSANTA.EXE file

DVDSANTA has been on My computer since nov 2004 when I purchased it Also
MCAFEE virus scan has been on my computer now For 5 years ( of course
newer versions as time progressed) AND WHY now doesn't mcafee like
DVDSANTA ?

 

[David H. Lipman]

From: "no one" <[email protected]>

| installation file is SETUP.EXE
|
| I just tried to install it on another computer and the same thing
| happens And That computer also is running the NEW DAT files from mcafee.
|
| This is the ERROR while installing
|
| C:\programfiles/dvdsanta/dvdsanta.exe
|
| AN ERROR occured while trying to rename a file in the destination
| directory : MOVIEFILE FAILED; CODE5.
| ACCESS IS DENIED
|
| Now if I disable MCAFEE DVDSANTA will install.. When I re-enable
| Mcafee, Mcafee immediately DELETES DVDSANTA.EXE saying it is infected .
| As I said originally.. Mcafee did the update and dvdsanta wasnot
| even running and Mcafee immediately says DVDSANTA is infected and
| DELETED the DVDSANTA.EXE file
|
| DVDSANTA has been on My computer since nov 2004 when I purchased it Also
| MCAFEE virus scan has been on my computer now For 5 years ( of course
| newer versions as time progressed) AND WHY now doesn't mcafee like
| DVDSANTA ?
|
| David H. Lipman wrote:


What version of McAfee software (corp or Retail), what is the Engine version and what is the
DAT revision ?

Disable McAfee and then submit "dvdsanta.exe" to Virus Total --
http://www.virustotal.com/flash/index_en.html
The submission will then be tested against 18 different AV vendor's scanners.

Another way to submit is to send the suspect file to the following email address
scan<at>virustotal.com
{ replace <at> with @ } with only the word SCAN as the subject.

Unfortunately, the web site is down so you'll have to send dvdsanta.exe via email to Virus
Total.

Please post back the EXACT results.

 

[Tommy]

http://www.dvdsanta.com



I download it ( DEMO) and and scan the installation file with Mcafee
virus scan and it says it is Virus FREE, but if I run the
installation file It Stops the install telling me it is INFECTED with
W32/SDBOT.WORM.T

Something is Fishy here since the NON-DEMO I bought (11/24/04) from
DVDSANTA does the SAME thing!

I redownloaded the FULL version from the private link and it ALSO SAYS
it is infected .

This all started with mcafee updating my DAT files on 04/27/05
Even tho the Virus was first discovered in 2003

Mcafee is no help... Spent 2 hours in Chat with them !

I have had Mcafee ver 9 and dvdsanta installed with no probs
today virusscan updated and now its deleted dvdsanta.exe
and will not let me reinstall
claims its infected with W3s/sdbot.worm.gen.t virus

 

[Roger Wilco]

http://www.dvdsanta.com



I download it ( DEMO) and and scan the installation file with Mcafee
virus scan and it says it is Virus FREE,

Any AV program that makes such a claim should be thrown in the trash. It
is almost impossible for software to make that determination. At best
they can state that none were found - which is entirely different.

but if I run the
installation file It Stops the install telling me it is INFECTED with
W32/SDBOT.WORM.T

Something is Fishy here since the NON-DEMO I bought (11/24/04) from
DVDSANTA does the SAME thing!

I redownloaded the FULL version from the private link and it ALSO SAYS
it is infected .

This all started with mcafee updating my DAT files on 04/27/05
Even tho the Virus was first discovered in 2003

Smells like a false positive detection (and a misidentification) to me.

Mcafee is no help... Spent 2 hours in Chat with them !

I'm sure by now they have had many users point this out to them and they
will soon have an updated update.

 

[no one]

I have had Mcafee ver 9 and dvdsanta installed with no probs
today virusscan updated and now its deleted dvdsanta.exe
and will not let me reinstall
claims its infected with W3s/sdbot.worm.gen.t virus

I finally got dvdsanta support to write me back on this issue


Here is their answers

If McAfee/ an antivirus program is running when you try to install,
please disable first, then install, then reenable your antivirus
protection. Development is aware that McAfee is picking up our program
and saying its a virus.

The download link to the latest full version of dvdSanta is



Now here is a link to others who are getting the same thing as of april
26, 2005 dat 4478
http://forums.mcafeehelp.com/viewtopic.php?p=230952#230952

 

[David H. Lipman]

| Tommy wrote:
||
||
||| http://www.dvdsanta.com
|||
|||
|||
||| I download it ( DEMO) and and scan the installation file with Mcafee
||| virus scan and it says it is Virus FREE, but if I run the
||| installation file It Stops the install telling me it is INFECTED with
||| W32/SDBOT.WORM.T
|||
||| Something is Fishy here since the NON-DEMO I bought (11/24/04) from
||| DVDSANTA does the SAME thing!
|||
||| I redownloaded the FULL version from the private link and it ALSO SAYS
||| it is infected .
|||
||| This all started with mcafee updating my DAT files on 04/27/05
||| Even tho the Virus was first discovered in 2003
|||
||| Mcafee is no help... Spent 2 hours in Chat with them !
||
||
|| I have had Mcafee ver 9 and dvdsanta installed with no probs
|| today virusscan updated and now its deleted dvdsanta.exe
|| and will not let me reinstall
|| claims its infected with W3s/sdbot.worm.gen.t virus
|
|
| I finally got dvdsanta support to write me back on this issue
|
|
| Here is their answers
|
| If McAfee/ an antivirus program is running when you try to install,
| please disable first, then install, then reenable your antivirus
| protection. Development is aware that McAfee is picking up our program
| and saying its a virus.
|
| The download link to the latest full version of dvdSanta is
|
|
|
| Now here is a link to others who are getting the same thing as of april
| 26, 2005 dat 4478
| http://forums.mcafeehelp.com/viewtopic.php?p=230952#230952

McAfee DAT is at v4479 as of Today.

 

[no one]

| Tommy wrote:
||
||
||| http://www.dvdsanta.com
|||
|||
|||
||| I download it ( DEMO) and and scan the installation file with Mcafee
||| virus scan and it says it is Virus FREE, but if I run the
||| installation file It Stops the install telling me it is INFECTED with
||| W32/SDBOT.WORM.T
|||
||| Something is Fishy here since the NON-DEMO I bought (11/24/04) from
||| DVDSANTA does the SAME thing!
|||
||| I redownloaded the FULL version from the private link and it ALSO SAYS
||| it is infected .
|||
||| This all started with mcafee updating my DAT files on 04/27/05
||| Even tho the Virus was first discovered in 2003
|||
||| Mcafee is no help... Spent 2 hours in Chat with them !
||
||
|| I have had Mcafee ver 9 and dvdsanta installed with no probs
|| today virusscan updated and now its deleted dvdsanta.exe
|| and will not let me reinstall
|| claims its infected with W3s/sdbot.worm.gen.t virus
|
|
| I finally got dvdsanta support to write me back on this issue
|
|
| Here is their answers
|
| If McAfee/ an antivirus program is running when you try to install,
| please disable first, then install, then reenable your antivirus
| protection. Development is aware that McAfee is picking up our program
| and saying its a virus.
|
| The download link to the latest full version of dvdSanta is
|
|
|
| Now here is a link to others who are getting the same thing as of april
| 26, 2005 dat 4478
| http://forums.mcafeehelp.com/viewtopic.php?p=230952#230952

McAfee DAT is at v4479 as of Today.

I just forced Mcafee to check for updates and it says I am current with
dat 4478

 

[David H. Lipman]

| I just forced Mcafee to check for updates and it says I am current with
| dat 4478
|

Curse of the retail product ! It is v4479, by 1330hrs on Friday ( Eastern time US ) it will
be v4480.

ftp://ftp.mcafee.com/pub/antivirus/superdat/intel/

 

[no one]

| I just forced Mcafee to check for updates and it says I am current with
| dat 4478
|

Curse of the retail product ! It is v4479, by 1330hrs on Friday ( Eastern time US ) it will
be v4480.

ftp://ftp.mcafee.com/pub/antivirus/superdat/intel/

UNABLE to find QUALIFYING productts when using sdat4479.exe or
4479xdat.exe
I am using Ver 9.1

 

[David H. Lipman]

From: "no one" <[email protected]>

|
|>> I just forced Mcafee to check for updates and it says I am current with
|>> dat 4478
|>>|
| UNABLE to find QUALIFYING productts when using sdat4479.exe or
| 4479xdat.exe
| I am using Ver 9.1
|


Like I said -- "Curse of the retail product !"

You can't use the SuperDAT on retail products after versions of retail VirusScan v7.x.

You can use the DAT file but it is a manual process !

ftp://ftp.mcafee.com/pub/antivirus/datfiles/4.x/

You would have to disable McAfee VirusScan and dowload the latest ZIP file. You would then
have to extract all DAT files from the ZIP file and save them in the McAfee ENGINE folder.
What that folder is under v9.x - I don't know but I will presume that the folder will be
located somewhere under...
C:\Program Files\Common Files

it could be...
C:\Program Files\Common Files\Network Associates
or
C:\Program Files\Common Files\Mcafee

Do a search in the "C:\Program Files\" folder area for Scan.dat will help pinpoint the
location.

 

[Tommy]

From: "no one" <[email protected]>

|

|>> I just forced Mcafee to check for updates and it says I am current with
|>> dat 4478
|>>
|
| UNABLE to find QUALIFYING productts when using sdat4479.exe or
| 4479xdat.exe
| I am using Ver 9.1
|


Like I said -- "Curse of the retail product !"

You can't use the SuperDAT on retail products after versions of retail VirusScan v7.x.

You can use the DAT file but it is a manual process !

ftp://ftp.mcafee.com/pub/antivirus/datfiles/4.x/

You would have to disable McAfee VirusScan and dowload the latest ZIP file. You would then
have to extract all DAT files from the ZIP file and save them in the McAfee ENGINE folder.
What that folder is under v9.x - I don't know but I will presume that the folder will be
located somewhere under...
C:\Program Files\Common Files

it could be...
C:\Program Files\Common Files\Network Associates
or
C:\Program Files\Common Files\Mcafee

Do a search in the "C:\Program Files\" folder area for Scan.dat will help pinpoint the
location.

I have done this and am now dat ver 4.0.4479
it still zaps dvdsanta .exe and deletes it
I did a full system scan. 'The result was no infected items found'
Then up pops a window to say that a virus has been found and deleted
C:\system volume information\-restore 6c28e47c-348-47fa
was infected by W32/sdbot.worm.gen.t virus and has been deleted
I wonder how it did that
As we know it cannot delete from system restore

Tommy

 

[David H. Lipman]

From: "Tommy" <tom@abc>


|
| I have done this and am now dat ver 4.0.4479
| it still zaps dvdsanta .exe and deletes it
| I did a full system scan. 'The result was no infected items found'
| Then up pops a window to say that a virus has been found and deleted
| C:\system volume information\-restore 6c28e47c-348-47fa
| was infected by W32/sdbot.worm.gen.t virus and has been deleted
| I wonder how it did that
| As we know it cannot delete from system restore
|
| Tommy

Who said so ?

As you can see, McAfee can !

Try again, v4480 is out.
ftp://ftp.mcafee.com/pub/antivirus/datfiles/4.x/

However, nothing is mentioned at...
http://vil.nai.com/vil/DATReadme.asp

 

[Tommy]

From: "Tommy" <tom@abc>


|
| I have done this and am now dat ver 4.0.4479
| it still zaps dvdsanta .exe and deletes it
| I did a full system scan. 'The result was no infected items found'
| Then up pops a window to say that a virus has been found and deleted
| C:\system volume information\-restore 6c28e47c-348-47fa
| was infected by W32/sdbot.worm.gen.t virus and has been deleted
| I wonder how it did that
| As we know it cannot delete from system restore
|
| Tommy

Who said so ?

McAfee says so

As you can see, McAfee can !

Claims to

I Followed the link to there site to check and it clearly states it
cannot be deleted from system restore and gives instructions to
disable system restore and then re-enable

Try again, v4480 is out.
ftp://ftp.mcafee.com/pub/antivirus/datfiles/4.x/

will do

 

[Tommy]

McAfee says so

Claims to

I Followed the link to there site to check and it clearly states it
cannot be deleted from system restore and gives instructions to
disable system restore and then re-enable


will do

Have updated to datfiles v 4480 and it seems to have solved the
problem as DVD Santa now works ok and Mcafee finds no virus when i
scanned it

 

[David H. Lipman]

From: "Tommy" <tom@abc>

|
| Have updated to datfiles v 4480 and it seems to have solved the
| problem as DVD Santa now works ok and Mcafee finds no virus when i
| scanned it

Finally resolution !

McAfee CAN delete file from the System Restore. However, it can corrupt the System Restore
database. That is why it is preffereable to disable the System Restore Cache prior to
scanning, especially when the "scan archhive files" attribute is set.

 

[no one]

Have updated to datfiles v 4480 and it seems to have solved the
problem as DVD Santa now works ok and Mcafee finds no virus when i
scanned it

GREAT NEWS

Does Mcafee send an apology to us for their MISTAKE

 

[David H. Lipman]

From: "no one" <[email protected]>


|
| GREAT NEWS
|
| Does Mcafee send an apology to us for their MISTAKE

I wouldn't bet on it ! That is unless they just post that information in a public place.

 

[Roger Wilco]

GREAT NEWS

Does Mcafee send an apology to us for their MISTAKE

Do you really think you deserve an apology for a false positive? You
really should rethink the decision you made to have that which is
detected automatically deleted by the AV. The same goes for any AV
product - false positive detections are a fact of life for AV scanners.
Have the suspect file brought to your attention so that YOU can make a
determination of how or whether to dispose of it. You can use other
scanners for secondary or tertiary opinions or use sites such as
'virustotal'. Chances are slim that a FP such as this would happen on
three different AV's engines or defs.