Raydr
Premium,MVM
join:2000-11-19
Carrollton, TX
 ·Verizon FIOS
| Filezilla uninstall.exe detected as Prockill-DF?
McAfee Antivirus, out of nowhere, came up with this today:
11/16/2005 7:33:06 PM Deleted MYUSERNAME explorer.exe C:\Program Files\FileZilla\uninstall.exe Prockill-DF (Trojan)
11/16/2005 11:28:48 PM Deleted NT AUTHORITY\SYSTEM svchost.exe C:\System Volume Information\_restore{FACF85BF-A410-4565-8F44-755C96DB94C9}\RP39\A0008147.exe Prockill-DF (Trojan)
I have installed nothing in the last several days. I did a quick google search and got no matches for for "prockill-df" or any relevant combinations of McAfee and FileZilla.
Anyone else get this? |
|
CalamityJane
Premium,VIP,MVM
join:2002-08-27
Eustis, FL
1 edit | Re: Filezilla uninstall.exe detected as Prockill-D
Hi Raydr,
Uh Oh! Looks like that may be a False Positive 
»www.programchecker.com/File.aspx/Id/1711
Unfortunately you have your AV set to delete any detected file. Probably not a good idea - is there a setting to quarantine instead (or with McAfee does the "deleted" notation put a copy in quarantine?) I'm asking because if you had a copy you could submit to McAfee to analyze, and they could either confirm or fix the detection signatures to correct the FP if that is the case.
Maybe you could try turning off McAfee, reinstall FileZilla to get the uninstaller back and then submit to them.
If you had that program for a while and McAfee is just now finding it - it could be that one of their recent updates did it.
--
It takes a disaster to make a woman out of a female
Microsoft MVP/Windows Security 2003-2006
Proud Member of ASAP (Alliance of Security Analysis Professionals) |
|
