Technical Discussion
  >> Security Related Issues


Register (or login) on our website and you will not see this ad.


These posts have been archived and can no longer be replied to or modified.
  Print Thread
Standard User deleted
(deleted) Sat 01-May-10 21:52:58
Print Post

ESET NOD32 V.4 - false positive with pwd zip


[link to this post]
 
Last night I needed to email a document and so added it to a password protected zip file and sent it via Outlook 2007 with the ESET NOD32 add on. The file never arrived and upon checking the delivery report I could see a message from ESET saying that there was a problem with the file. So I investigated.
I ran the file again through NOD32 and got the same problem again.
I ran the file through several other virus checkers including OA++, A-squared, Trojan Hunter and Sophos. Then I uploaded the file to virustotal.com. Each scan came through clean.
I then unzipped the file and scanned the original unzipped document with NOD32. It came through as clean.
I zipped it again but this time with 128bit encryption- not 256 and it tested positive again.
I tried a variety of other files - just simple text files from notepad by zipping with encryption and each time produced a false positive with NOD32.

The version of NOD32 is 4.0.474 and virus signature is 5077 which I believe updated abouyt 25 minutes ago


I am curious as to whether this is a known bug with NOD32. or winzip. btw I am using winzip 14 but i was creating a .zip and not a .zipx file
Standard User deleted
(deleted) Sat 01-May-10 21:56:51
Print Post

Re: ESET NOD32 V.4 - false positive with pwd zip


[re: deleted] [link to this post]
 
In reply to a post by zhugeliang:
Last night I needed to email a document and so added it to a password protected zip file and sent it via Outlook 2007 with the ESET NOD32 add on. The file never arrived and upon checking the delivery report I could see a message from ESET saying that there was a problem with the file. So I investigated.
I ran the file again through NOD32 and got the same problem again.
I ran the file through several other virus checkers including OA++, A-squared, Trojan Hunter and Sophos. Then I uploaded the file to virustotal.com. Each scan came through clean.
I then unzipped the file and scanned the original unzipped document with NOD32. It came through as clean.
I zipped it again but this time with 128bit encryption- not 256 and it tested positive again.
I tried a variety of other files - just simple text files from notepad by zipping with encryption and each time produced a false positive with NOD32.

The version of NOD32 is 4.0.474 and virus signature is 5077 which I believe updated abouyt 25 minutes ago


I am curious as to whether this is a known bug with NOD32. or winzip. btw I am using winzip 14 but i was creating a .zip and not a .zipx file
That'll be because it can't decrypt a protected zip, so it "fails safe".
Standard User deleted
(deleted) Sun 02-May-10 00:14:13
Print Post

Re: ESET NOD32 V.4 - false positive with pwd zip


[re: deleted] [link to this post]
 
I gather that. I just find it strange that it is only an issue with NOD32 and none of the others.


Register (or login) on our website and you will not see this ad.

Standard User Pipexer
(eat-sleep-adslguide) Sun 02-May-10 00:27:31
Print Post

Re: ESET NOD32 V.4 - false positive with pwd zip


[re: deleted] [link to this post]
 
In reply to a post by zhugeliang:
I gather that. I just find it strange that it is only an issue with NOD32 and none of the others.

What virus name exacly did it detect? You may find it explains in the virus name that it is just an encypted file, or whatever?

______________
Zen 8000 Active
Standard User Banger
(eat-sleep-adslguide) Sun 02-May-10 02:36:29
Print Post

Re: ESET NOD32 V.4 - false positive with pwd zip


[re: deleted] [link to this post]
 
V4.2.40 is out might be worth a program update?

Tim
ZeN & freenetname
ST546v6 on 8 Meg Active
Check my bad boy speeds out on ZeN
  Print Thread

Jump to