Bits from Bill

Technology thoughts leaking from the brain of "Bill Pytlovany"

Wednesday, June 20, 2007

Do All Signatures Come From Kaspersky?

You might think there exists a huge number of anti-malware programs out there. If so, you’d be right but you might be surprised to find out how many use the same anti-virus engine and signature files.

My mailbox was flooded yesterday with a number of freaked out WinPatrol users who had our software removed by Kaspersky Internet Security Suite. It seems Kaspersky was identifying WinPatrol as “pornware not-a-virus:Porn-Dialer.Win32.Agent.aw“.

I was pleased that most folks knew this must be some kind of false-positive error, but I also had my share of users in a panic blaming me for infecting their systems.

By evening, I did hear back from Kaspersky Virus Analyst, Yury Nesmachny who apologized and said,

Sorry, it's false alarm. Its detection will be deleted in the next update. Thank you for your help.”

According to tests today with VirusTotal.com, Kaspersky has corrected this error.


I had created a standard reply for Kaspersky users but as the day continued it got worse. Apparently, a significant number of other products use signature files from Kaspersky for their products.

It wasn’t long before I received notices that Zone Alarm Security Suite was reporting WinPatrol as a porn dialer. This was followed by a couple F-Secure Internet Security users and a few who use AOL’s Active Virus Shield.


This isn’t the first time this error has occurred. Last December Panda Software tried to tell users WinPatrol was a porn dialer. Panda was pretty responsive and I appreciate the quick action from Kaspersky which hopefully, will be deployed quickly to all their partners. I’ve also been told WinPatrol isn’t alone. AdobeUpdaterInstallMgr, Quicken and many other popular applications were mis-identified.

Update: Thanks to Don Pelotas who pointed me to this list of Kaspersky partners.
http://www.kaspersky.com/oemsuccess

Labels: , ,

Share on Facebook


5 Comments:

Blogger Unknown said...

I have the same problem with AVG. It identifies a telephone dialer virus linked to WinPatrol.

3:02 PM  
Blogger Salar37_Shushan said...

I got the Zone-alarm error too. Glad I came to read your blog before emailing you as well *g*

3:42 PM  
Anonymous Anonymous said...

F-Secure is tagging my WinPatrol as a porn dialer also. The only way I could get through a complete scan was to remove WinPatrol.

F-Secure has been been responsive. Their reply to my Scan Report says they are aware an issue associated with WinPatrol and they are investigating it.

I hope they figure it out really soon.

Thanks Bill.

11:02 PM  
Anonymous Anonymous said...

People out there who have been using WIN PATROL for a while you should have realized that Win Patrol is not a virus.
If Bill P. was that devious to cause you to get a virus from his Win Patrol program he would not have his name address + Ph # on his site.
This is a classic chain reaction on programs. Use good judgment but when an apps does its job right for so many years you got to have doubt its gone bad.
Keep up the good work!

7:37 AM  
Anonymous Anonymous said...

That figures.

Its times like this I am glad I still use the old free version of Sygate Personal Firewall and NOD 32 for my Antivirus program.

But I need to thank you for the great suggestion of moving away from Norton as my antivirus. NOD 32 runs so much better with less memory usage.

12:44 AM  

Post a Comment

<< Home