“This includes trojans written in multiple HLLs, including MSVC, MSVB and Delphi,” claims McAfee. McAfee explains that the false positive resulted because that particular definition is designed to generically detect multiple Trojan-type malicious applications that steal passwords. Due to the faulty signatures, the McAfee products quarantined or completely deleted the conime.exe (Windows Vista console IME) file, which they generically detected as belonging to the PWS-LegMir Trojan. The 5409 DAT files released on Octocontained a bad signature that falsely detected a legit Windows Vista component as malware.
The false positive was corrected in a later definitions update. The Windows Vista console IME was incorrectly tagged by McAfee's security products as Trojan PWS-LegMir due to a faulty definitions file.
0 kommentar(er)
