<html>
<head>
<style>
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
FONT-SIZE: 10pt;
FONT-FAMILY:Tahoma
}
</style>
</head>
<body class='hmmessage'>
<BR>From what I found <FONT face=Arial>Kaspersky and F-Prot both will report it and both use the same virus description file.</FONT><BR>
Other AV's don't find it.<BR>
I'd be 99% sure it's a false positive.<BR>
<BR> <BR>
<HR>
<BR>
Subject: RE: [Xerte] Worm in installer?<BR>Date: Sat, 4 Oct 2008 22:33:22 +0100<BR>From: Julian.Tenney@nottingham.ac.uk<BR>To: xerte@lists.nottingham.ac.uk<BR><BR><BR>
<META content="Microsoft SafeHTML" name=Generator>
<STYLE>
</STYLE>
<DIV id=EC_idOWAReplyText13985 dir=ltr>
<DIV dir=ltr><FONT face=Arial color=#000000 size=2>You're the first to report it. I shall take a very keen interest if it proves to be more serious.</FONT></DIV>
<DIV dir=ltr><FONT face=Arial size=2></FONT> </DIV>
<DIV dir=ltr><FONT face=Arial size=2>thanks,</FONT></DIV></DIV>
<DIV dir=ltr><BR>
<HR>
<FONT face=Tahoma size=2><B>From:</B> xerte-bounces@lists.nottingham.ac.uk on behalf of Alan at PTT<BR><B>Sent:</B> Sat 04/10/2008 15:05<BR><B>To:</B> xerte@lists.nottingham.ac.uk<BR><B>Subject:</B> [Xerte] Worm in installer?<BR></FONT><BR></DIV>
<DIV>
<DIV><FONT face=Arial size=2>Hello,</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Downloaded Xerte Setup [created 27 Sep 16:45 length 15,242,328 bytes]. My copy of The Shield (which is Kaspersky AV] reports Worm.Win32.AutoRun.pze in file 232 and can't disinfect it. Probably a false positive, but I thought I'd ask if anything is known about this.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Alan Knight</FONT></DIV></DIV><br /><hr />See how Windows connects the people, information, and fun that are part of your life. <a href='http://clk.atdmt.com/MRT/go/msnnkwxp1020093175mrt/direct/01/' target='_new'>See Now</a></body>
</html>