Possible false positive on latest dat files from McAfee

[helen]

I am not 100%,but suspiciously McAfee (yes I know, not my choice) grabbed some new dat files this morning and subsequently decided that both Flare 5.0.1 (which I was installing at the time) and Flare 5.0 (which I subsequently rolled back to) were in fact a generic trojan - detected as 'Artemis' - also known as "we don't know what this is, but we don't like it".

It wouldn't be the first false positive I've had from McAfee so if you are running that - be aware that this morning may not go to plan. I'm waiting to hear from MadCap support - I think I'll have to contact McAfee direct to get a patch though (I doubt very much it's MadCap releasing viruses, lol).

Of course, I may in fact have a virus, but in the name of being aware - I thought I'd share this morning's pain.

[Adrian Durand]

Hi Helen,

I know this isn't going to help much, but I also run McAfee and I've just installed V5.01. I've now opened Flare and loaded my project and so far I've not had any pop-ups reporting a virus.
Can you let me know exactly when this message was encountered, so I can try to duplicate the steps you carried out to see if it is a problem with Flare, McAfee or is actually a virus.

Many Thanks

Adrian

Edit:
On speaking to our Technical Department, depending on the security level set for McAfee, a message can be displayed irrespective of what is being installed.
This will occur if the security settings are set to their highest level.
Could be worth checking with your Technical staff to see if this is the case, or if the settings have been changed recently.

[helen]

Hmm, interesting. I'm afraid McAfee bit the dust this morning and a new virus checker went on in my fury - it doesn't think I have a virus.

We don't have a technical department as such... I can inform you that everything was fine until McAfee grabbed it's latest DAT and then both Flare 5.0.1 and Flare 5.0 were apparently a generic virus, I've attached the screen shot from the McAfee log. I don't know what security level it was set to as it's now been banished to the naughty corner forever more.

[KevinDAmery]

That's interesting, it doesn't like the microsoft installation program. Well, it's not alone in that regard but I think even Microsoft's most vehement critics aren't about to call the msi installer a virus (crappy code, maybe, but a virus? doubt it....)

[RamonS]

McAfee is known for being very broad in their virus definitions. We had a run in with them some months ago after they tagged all our software as virus and trojan, typically we are a Delphi shop and all virus scanner vendors hate Delphi code (I think Delphi is way better than .NET, especially in making small executables).
I think MadCap should make their most stressed and annoyed employee call McAfee and let him or her really go at them. Our experience is that they otherwise don't bother with it.

[helen]

As I think we all suspected and MadCap have confirmed - it's McAfee being a bit too ambitious on their virus definitions. I have since removed it and all is well in the world of Flare again (and my comptuer runs so much faster)!

[SteveS]

I've added a fix for this to another thread: http://forums.madcapsoftware.com/viewto ... 666#p58666

Basically, turn off McAfee, add the offending exe to the trusted program list, and turn protection back on.

As anyone using McAfee can atest, there is no off button, so you have to delve into McAfee configuratioin to do it, so I've included screen shots.

HTH