Author: ArtArt
Date: Jan 11, 2007 05:56
On 11 Jan 2007 04:16:13 -0800, "Duh_OZ" gmail.com> wrote:
>Back in July 2005 I reported how a small script file was being reported
>as "Univ.bat/a" by McAfee and Sybari. Fast forward to 2007. I
>submitted to virustotal again, and although McAfee now says it is clean
>(which it is) a few other vendors are calling a Zapchast variant.
>Little trouble making file keeps popping up false positives :0)
I'm speculating that the batch has found its way into test beds of
testing agencies such as av-comparatives, in which case vendors will
refuse to remove the fp. If I'm right, you can expect McAfee and
Sybari to start alerting again soon, along with several more products
which never used to produce the fp :) The harmless batch will be
deemed malware by decree of av-comparatives and the like ... not by av
company analyists. Like we always used to say back in my engineering
days, bullshit beats science! An engineer's nightmare is a marketeers
dream and vice versa! The marketplace rulez!!! Hey, false positives
sell, man!
:)
|