False Positive on NSISDL.DLL

[Mark H]

My up-to-date version of AntiSpyware is incorrectly
identifying a file as a
Trojan downloader (Trojan.Downloader.NSISdl).

The file it identified is NSISDL.DLL, which is a part of
the Nullsoft
Install System program available at
nsis.sourceforge.netand is *not* any kind
of trojan. The source code for this product is available
for inspection on
the site, and it contains no Trojan or other unsavory
code. The author of
the software has a statement at
http://nsis.sourceforge.net/index.php?
id=2&backPID=2&tt_news=24 for review.

Based on web searches, it appears that both Symantec and
McAfee have at one
time or another also misidentified this file as a
problem, but have since
corrected their virus signature updates to correct this
misidentification.

 

[Bill Sanderson]

Thanks - This has been discussed some here, and Steve Dodson, from Microsoft
is investigating what is happening with fixing the issue.

 

[Jason McKinnon]

Bill, Steve, et al...

Thanks so much for looking into this. It appears that the problem has
finally been resolved in the 5723 definitions. You have no idea how
relieved I am to know that I can now confidently make use of the NSIS
downloader module without MSAS removing it.

Thank you for your continued patience with us NSIS users over the past month
and a half.

Jason McKinnon

 

[Bill Sanderson]

My experience is that false positives are resolved quite quickly once they
are clearly understood. Thanks for reporting the issue, and for reporting
the fix!

--

 

[john259]

Guys,

Thanks so much for fixing the NSIS issue, it is very
greatly appreciated.

John