Possible False Positive for Trojan Horse

Norton AntiVirus detects a supposed trojan horse in various game trainers, and then proceeds to delete them. One of the game trainers it detects a trojan horse in and then deletes is the trainer for C&C 3 Red Alert 1.09. I do know for a fact that there is no trojan horse or other malware in this trainer, or the trainer for Company of Heroes 1.03 Trainer.

 

I have strong reason to believe these are false positives, as Norton AntiVirus 2010, does not show what Trojan Horse it is supposedly detecting. The program did submit information to Symantec.

 

 

Norton AntiVirus detects a supposed trojan horse in various game trainers, and then proceeds to delete them. One of the game trainers it detects a trojan horse in and then deletes is the trainer for C&C 3 Red Alert 1.09. I do know for a fact that there is no trojan horse or other malware in this trainer, or the trainer for Company of Heroes 1.03 Trainer.

 

I have strong reason to believe these are false positives, as Norton AntiVirus 2010, does not show what Trojan Horse it is supposedly detecting. The program did submit information to Symantec.

 

 

Yes, they were plain EXE's. I strongly suspect these are false positives, as no other antivirus program on the market detects anything in these files.

 

I did a deep scan, after doing a quick scan.

 

I looked at the history logs, and no where does it say what trojan horse is in there. Program did do it's job, in submitting samples to Symantec. Right now, everything is in quarantine.

Hi Nightowl1:

 

If the files are truly in Quarantine, they are not actually removed from your system.

 


Restoring an item from Quarantine:

 

Some programs rely on other programs that are classified as security risks to function. The program may not function if a particular security file is removed. All of the removed security risks are automatically backed up in the Security History Quarantine. This way, NAV lets you restore any risk to regain the functionality of a program that requires the risk program to run.

 

For example, a shareware or freeware program that you download may use adware to keep its price low. In this case, you can allow the security risk program to remain on your computer or restore it if spyware protection has removed it.

 

Some quarantined items are successfully disinfected after NAV rescans them. You can also restore such items.

 

Note:

If you restore an item to a directory other than its original location, it may not function properly. Therefore, it is recommended that you reinstall the program.

 

To restore an item from the Quarantine:

  1. In the Security History window, in the Quarantine view, select the item that you want to restore.

  2. Click Options.

  3. In the Threat Detected window, click Restore this file.

  4. In the Quarantine Restore window, click Yes.

  5. Click Close.

This window also displays the details of the item that you want to restore. You can use the option that is available in this window to exclude the item from being detected in the future scans.

 

Note:

Restoring a quarantined item can put your system at risk.


 

Hope this helps.

Message Edited by Plankton on 12-22-2009 01:40 AM

Hi Nightowl1

 


Yes, they were plain EXE's. I strongly suspect these are false positives, as no other antivirus program on the market detects anything in these files


Do you have any other security programs in your computer?

Please try to submit them here Malware Submission and here  Threat Expert

They will have a look at them and see they are no malware 

I submitted everything to Symantec, and now I wait. Program is good, but something like this doesn't bother me too much, it did remove something the last AV program I had missed entirely don't remember what that item was.

 

Hi Nightowl1 :

 

If you feel that the file being detected by Norton is a False Positive then you can submit it to False Positive Submissions.


Message Edited by Shridhar on 12-22-2009 10:07 PM