False Positive

[Guest]

Hi,

Just made a first scan with the new spyware definitions -
5729 (21-Jul-05 22:16:55) - and got a false positive item:
in our development tree we have a js file called
iebase.js. The file was needed for backward compatibility,
and it contained a line of spaces - clearly no threats.

This file was detected by the anti-spyware as
IST.PowerScan Adware from Integrated Search Technologies.

Someone should check the spyware signatures ?

Thanks,

 

[-Dan-]

My limited experience (one incident), indicates that it checks filename only. You will probably need to "Ignore" that file.

--
--Dan--



| Hi,
|
| Just made a first scan with the new spyware definitions -
| 5729 (21-Jul-05 22:16:55) - and got a false positive item:
| in our development tree we have a js file called
| iebase.js. The file was needed for backward compatibility,
| and it contained a line of spaces - clearly no threats.
|
| This file was detected by the anti-spyware as
| IST.PowerScan Adware from Integrated Search Technologies.
|
| Someone should check the spyware signatures ?
|
| Thanks,
| ---
| Vittaly.
|
| P.S. The real mail: (e-mail address removed)
|

 

[Cal]

I think the most recent spyware definition is 5735, not 5729.

Not that that will probably help with false positives, but I thought I should
mention it. ; )

 

[plun]

Well, it´s 5737 today.

Menu file, check for updates !

 

[Cal]

Whoopsie, I knew that.

Sorry. ; )~

 

[Bill Sanderson]

Thanks for posting this.

You might also post it in the .signatures group as well--Microsoft looks
there for false-positive reports.

I agree with the reply that this detection may well be based on the
filename--or perhaps on some spyware or virus being developed with the same
tools you are using.

If this detection will impact your final development product, you can report
it as a vendor using the form found here:

http://www.microsoft.com/athome/security/spyware/software/isv/fpform.aspx