<HTML dir=ltr><HEAD>
<META http-equiv=Content-Type content="text/html; charset=unicode">
<STYLE>
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
FONT-SIZE: 10pt;
FONT-FAMILY:Tahoma
}
</STYLE>
<META content="MSHTML 6.00.6000.16705" name=GENERATOR></HEAD>
<BODY class=hmmessage>
<DIV id=idOWAReplyText56720 dir=ltr>
<DIV dir=ltr><FONT face=Arial color=#000000 size=2>Deep down in my memory banks I seem to remember a similar false positive issue. It was a long time ago, and was due to a particular version of Zinc throwing false positives in some AVs. I'm not sure what to do to be 100% if 99% isn't good enough...?</FONT></DIV></DIV>
<DIV dir=ltr><BR>
<HR tabIndex=-1>
<FONT face=Tahoma size=2><B>From:</B> xerte-bounces@lists.nottingham.ac.uk on behalf of Dave Burnett<BR><B>Sent:</B> Sun 05/10/2008 01:34<BR><B>To:</B> Xerte discussion list<BR><B>Subject:</B> RE: [Xerte] Worm in installer?<BR></FONT><BR></DIV>
<DIV><BR>From what I found <FONT face=Arial>Kaspersky and F-Prot both will report it and both use the same virus description file.</FONT><BR>Other AV's don't find it.<BR>I'd be 99% sure it's a false positive.<BR><BR> <BR>
<HR>
<BR>Subject: RE: [Xerte] Worm in installer?<BR>Date: Sat, 4 Oct 2008 22:33:22 +0100<BR>From: Julian.Tenney@nottingham.ac.uk<BR>To: xerte@lists.nottingham.ac.uk<BR><BR><BR>
<STYLE>
</STYLE>
<DIV id=EC_idOWAReplyText13985 dir=ltr>
<DIV dir=ltr><FONT face=Arial color=#000000 size=2>You're the first to report it. I shall take a very keen interest if it proves to be more serious.</FONT></DIV>
<DIV dir=ltr><FONT face=Arial size=2></FONT> </DIV>
<DIV dir=ltr><FONT face=Arial size=2>thanks,</FONT></DIV></DIV>
<DIV dir=ltr><BR>
<HR>
<FONT face=Tahoma size=2><B>From:</B> xerte-bounces@lists.nottingham.ac.uk on behalf of Alan at PTT<BR><B>Sent:</B> Sat 04/10/2008 15:05<BR><B>To:</B> xerte@lists.nottingham.ac.uk<BR><B>Subject:</B> [Xerte] Worm in installer?<BR></FONT><BR></DIV>
<DIV>
<DIV><FONT face=Arial size=2>Hello,</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Downloaded Xerte Setup [created 27 Sep 16:45 length 15,242,328 bytes]. My copy of The Shield (which is Kaspersky AV] reports Worm.Win32.AutoRun.pze in file 232 and can't disinfect it. Probably a false positive, but I thought I'd ask if anything is known about this.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Alan Knight</FONT></DIV></DIV><BR>
<HR>
See how Windows connects the people, information, and fun that are part of your life. <A href="http://clk.atdmt.com/MRT/go/msnnkwxp1020093175mrt/direct/01/" target=_new>See Now</A> </DIV></BODY></HTML>