Is this a false positive or bug with IE 6, McAfee 8/9/10 or both IE 6 and McAfee?

GG

unread,

Jun 26, 2006, 6:57:52 AM6/26/06

to

I get this error on two machines with IE6 and McAfee
When going to http://starwarsspoofs.com/, McAfee reports a problem.
Anyone else using Mcafee 8, 9 or 10 and have this same problem?
I get a Generic Downloader.0 trojan found message.
http://vil.nai.com/vil/content/v_131316.htm

My McAfee specs:
Mcafee Virusscan 10.0
Build 10.0.27
Engine version 4450
Dat version 4792
Dat file created 6/23/2006

When using IE Mcafee reports a trojan.
When using Firefox Mcafee doesn't.
I guess it's just something funky between IE and Mcafee.

Anyone else using McAfee 8, 9 or 10 and have dat file 4422 - 4769?
If so, do you get this error?
I've already done a McAfee full scan in normal and safe mode.
McAfee says my pc is clean.

I posted this info on McAfee's online forum.
I'll be checking McAfee's and this thread daily.
So, what is the cause of this problem?
Is this problem a false positive?
IE 6, McAfee 8/9/10 or http://starwarsspoofs.com/
Any info is appreciated!

http://webpages.charter.net/flashtv/stuff/starwarsspoofs1.JPG

David H. Lipman

unread,

Jun 26, 2006, 1:19:13 PM6/26/06

to

From: "GG" <nos...@charter.net>

To start with, you Engine version is funky.
The latest is v4400 (sans Beta 5000 which I use)

Well my v7.1E also flags the HTML page.

6/26/2006 1:08:25 PM Delete failed (Clean failed) DLIPMAN-1\lipman D:\temp\IE6\Temporary
Internet Files\Content.IE5\4LUTYVAL\starwarsspoofs[1].htm Generic Downloader.o

But... No other vendor does. I will submit it to McAfee as a False Positive

AntiVir 6.35.0.16 06.26.2006 no virus found
Authentium 4.93.8 06.23.2006 no virus found
Avast 4.7.844.0 06.26.2006 no virus found
AVG 386 06.26.2006 no virus found
BitDefender 7.2 06.26.2006 no virus found
CAT-QuickHeal 8.00 06.26.2006 no virus found
ClamAV devel-20060426 06.26.2006 no virus found
DrWeb 4.33 06.26.2006 no virus found
eTrust-InoculateIT 23.72.49 06.25.2006 no virus found
eTrust-Vet 12.6.2275 06.26.2006 no virus found
Ewido 3.5 06.26.2006 no virus found
Fortinet 2.77.0.0 06.26.2006 no virus found
F-Prot 3.16f 06.23.2006 no virus found
Ikarus 0.2.65.0 06.26.2006 no virus found
Kaspersky 4.0.2.24 06.26.2006 no virus found
McAfee 4793 06.26.2006 Generic Downloader.o
Microsoft 1.1481 06.25.2006 no virus found
NOD32v2 1.1625 06.26.2006 no virus found
Norman 5.90.21 06.26.2006 no virus found
Panda 9.0.0.4 06.26.2006 no virus found
Sophos 4.07.0 06.26.2006 no virus found
Symantec 8.0 06.26.2006 no virus found
TheHacker 5.9.8.165 06.26.2006 no virus found
UNA 1.83 06.26.2006 no virus found
VBA32 3.11.0 06.26.2006 no virus found
VirusBuster 4.3.7:9 06.25.2006 no virus found

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

GG

unread,

Jun 26, 2006, 4:30:06 PM6/26/06

to

Thx.
I posted this info to McAfee's website and emailed them the .htm file
yesterday.
Both McAfee and you agree that it's a false positive.
Thx for your input!
"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message
news:Ogi6mSUm...@TK2MSFTNGP04.phx.gbl...

David H. Lipman

unread,

Jun 26, 2006, 5:37:42 PM6/26/06

to

From: "GG" <nos...@charter.net>

Still not corrected though by DAT v4793 :-(

GG

unread,

Jun 27, 2006, 6:14:27 AM6/27/06

to

Check this out.
I uninstalled and reinstalled McAfee.
I now have engine 4400 back.
I've seen other people mention 4450 also.
Who knows why certain people get 44550 vs 4400.
After reinstalling, I no longer get the error with engine 4400.
Here are my specs after reinstalling:

My McAfee specs:
Mcafee Virusscan 10.0

Build 10.0.21
Engine version 4400
Dat version 4793
Dat file created 6/26/2006

These were my original specs:

My McAfee specs:
Mcafee Virusscan 10.0
Build 10.0.27
Engine version 4450
Dat version 4792
Dat file created 6/23/2006

I have one more machine with engine 4450.
I'll check it in about two months to see if it gets a new engine.
If not, I'll reinstall McAfee on it.
I wonder if you uninstalled Mcafee enterprise 8 on your machine and had
another engine besides the beta one would you still get the same error?

Here are some users with engine 4450.
http://forums.mcafeehelp.com/viewtopic.php?t=58983
http://forums.mcafeehelp.com/viewtopic.php?t=57645

It appears that anyone with engine 4450 gets build 10.0.27.
I wonder if I'll get 4450 back again when my machine is auto updated?

"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in message

news:eLDTDjW...@TK2MSFTNGP05.phx.gbl...

David H. Lipman

unread,

Jun 27, 2006, 6:42:57 PM6/27/06

to

From: "GG" <nos...@charter.net>

]

Detection is in the signature not the Engine. I'll have to do some research on Engine v4450
and what this version is about. The standard SuperDAT deploys Engine v4400 and the latest
DAT. The Engine only SuperDAT provides v4400. I use v5000 Beta. I am using McAfee
Enterprise VirusScan v7.1E. That's a corporate version and not a retail version like you
are using.