PDA

View Full Version : infected file ??



Michael Clease
01-02-2009, 23:53
I suspect this is a false positive but i am getting report of an infected file with norman malware cleaner but thought I better report it.

C:\thinBasic\Lib\thinBasic_Registry.dll (Infected with W32/Conficker.FA)

http://www.norman.com/Virus/Virus_descriptions/54793/en-uk?show=default

ErosOlmi
02-02-2009, 00:08
Thanks for reporting.
Yes, of course is a false positive. Some sequence of char in that thinBasic_Registry.DLL must match virus signature.

What I usually do in those cases is to recompile the DLL with few different options in such a way (if I'm lucky) the marked sequence of char does not match virus signature. It is a "change & try" method but I do not know what else I can do.

Ciao
Eros

ErosOlmi
02-02-2009, 00:21
Just to let all users know

_________________________________________________

All computers used for thinBasic development are protected by TrendMicro OfficeScan Corporate edition (http://us.trendmicro.com/us/products/enterprise/officescan-client-server-edition/index.html). I use this one because it is installed by my company policy.

Before releasing any thinBasic version, thinBasic setup is installed on other 2 computers where it is running Kaspersky AV (http://www.kaspersky.com/) in one computer and AVG Free Edition in the other (Virtual machine used only for testing purposes)
All AV software are updated to the last version available at the time thinBasic is released.

After that thinBasic is also uploaded to some well known download web sites that usually certify the software. One of the most important is for sure Softpedia that certify that thinBasic is virus, spyware, adware free: http://www.softpedia.com/get/Programming/Coding-languages-Compilers/thinBasic.shtml

Regards
Eros