You are here

[Fixed] PidginPortable.exe contains virus Generic.dx!oxp? I doubt it.

18 posts / 0 new
Last post
eleavings
Offline
Last seen: 8 years 9 months ago
Joined: 2006-11-27 09:34
[Fixed] PidginPortable.exe contains virus Generic.dx!oxp? I doubt it.

So a McAfee virus signature update I just received has caused McAfee to automaitcally delete the file PidginPortable.exe if I try and start Pidgin. It deletes it even if I just browser the directory.

This McAffee page ( http://vil.nai.com/vil/content/v_260131.htm ) shows the virus it is supposedly finding.

This seems like a false positive to me.

I have no way to stop McAfee as this is on a work laptop and we are locked out from making exceptions in McAfee.

Anyone have any ideas?

computerfreaker
computerfreaker's picture
Offline
Last seen: 12 years 6 months ago
Developer
Joined: 2009-08-11 11:24
Can you upload the file to

Can you upload the file to VirusTotal, then post the link to the VT results here?
It's probably a false positive, but it never hurts to make sure.

If it is a false positive, this is what you need.

"The question I would like to know, is the Ultimate Question of Life, the Universe and Everything. All we know about it is that the Answer is Forty-two, which is a little aggravating."

eleavings
Offline
Last seen: 8 years 9 months ago
Joined: 2006-11-27 09:34
Yep that's just what I

Yep that's just what I did.
http://www.virustotal.com/analisis/8284f87445f623d7c7aeb375621c375ab7456...

Also check with Kaspersky, Norton and Clamwin.

It's a false positive.

Thanks for the McAfee link. I will report it to them!

Eleavings

Amarus
Amarus's picture
Offline
Last seen: 11 years 8 months ago
Joined: 2008-04-25 17:00
I just want to say...

I just want to say that the same thing happened to me. Glad to know that I'm not the only one.

Bytheway, how can I get McAfee from deleting the file? I don't want ot turnoff the active-virus-scan feature off. Any suggestions or steps on how to do this?

in_vino_veritas,_in_aqua_sanitas.

phatmik3
Offline
Last seen: 14 years 2 weeks ago
Joined: 2010-03-11 14:35
McAfee

McAfee deleted my executable file as well. However, it did not delete the pidgin-portable.exe file in the directory PidginPortable\App\Pidgin. I use the PStart portable program launcher, so I just changed my shortcut to point to the other executable file and it functions just as before.

Does anyone know if using that executable file instead changes the portable nature of the program?

Darkbee
Darkbee's picture
Offline
Last seen: 3 years 10 months ago
Joined: 2008-04-14 09:41
It's asbolutely necessary!

Yes it does. The launcher app is need to make sure that your application data is being saved in the right location and also that the app cleans up after itself (removing registry entries for example).

Your method is not recommended at all, you might as well just download the non portable version direct from the Pidgin website.

me36835
Offline
Last seen: 4 years 8 months ago
Joined: 2007-03-15 14:19
Workaround

Hello,

I am affected by the same issue.

Therefore, I did install elder versions of pidgin portable.

2.6.5 is affected as well

2.6.4 does work.

Here i found the 2.6.4 Version, which works on my stick now: http://download.freenet.de/startdownload/Portable-Pidgin-USB-2.6.4-deuts...

Cheers / Thomas

mrkgalli
Offline
Last seen: 13 years 9 months ago
Joined: 2010-02-27 03:44
same for me

alas, McAfee my pidginportable.exe for the same reason, and I can't manage to turn it off or restore the quarantined file as I'm on a working PC and got no admin rigth ont the antivirus...

hope to get a workaround for the new version of pidgin as fas as possible... I'll download the older one in the meantime...

Virus, Item Name: J:\PortableApps\PidginPortable\PidginPortable.exe, Detection Name: Generic.dx!oxp, ScanCompleted: 0

eleavings
Offline
Last seen: 8 years 9 months ago
Joined: 2006-11-27 09:34
Reported to McAfee

Hey folks. As computerfreaker suggested, I've reported the issue to McAfee with explanation and attached the file (zipped and pw protected). So hopefully it will make it's way through the corporate machine and get fixed.

The email to report a false positive to McAfee is: virus_research @ avertlabs.com
They request that in the email you report the version of VirusScan and the DAT version listed on the About screen.

Also, youu should attach the file in question zipped and password protected with the password: infected.

And the subject line should start with the word: FALSE

Eleavings

fortec
Offline
Last seen: 14 years 3 weeks ago
Joined: 2006-10-04 13:53
Sourceforge location for Pidgin Portable 2.6.4

Here's the location on Sourceforge for the most recent version that isn't effected by McAfee:
http://sourceforge.net/projects/portableapps/files/Pidgin Portable/Pidgin Portable 2.6.4/PidginPortable_2.6.4.paf.exe/download

computerfreaker
computerfreaker's picture
Offline
Last seen: 12 years 6 months ago
Developer
Joined: 2009-08-11 11:24
http://sourceforge.net/projec

"The question I would like to know, is the Ultimate Question of Life, the Universe and Everything. All we know about it is that the Answer is Forty-two, which is a little aggravating."

blackneuron
Offline
Last seen: 14 years 2 weeks ago
Joined: 2010-03-02 08:43
I keep getting a 500 error

I keep getting a 500 error when trying to go to either link. So i guess I will have to wait for McAfee.

computerfreaker
computerfreaker's picture
Offline
Last seen: 12 years 6 months ago
Developer
Joined: 2009-08-11 11:24
Try mine again

Try mine again; it had an extra space in it, which I just fixed.

"The question I would like to know, is the Ultimate Question of Life, the Universe and Everything. All we know about it is that the Answer is Forty-two, which is a little aggravating."

blackneuron
Offline
Last seen: 14 years 2 weeks ago
Joined: 2010-03-02 08:43
THANK YOU! I was going

THANK YOU! I was going through withdraw, lol. It so sucks when you rely on something and then you can't use it.

brononi
Offline
Last seen: 14 years 2 weeks ago
Joined: 2010-03-12 01:15
Same issue over

Same issue over here.
PortableApps.exe is found as a virus and deleted, and the pidgin aswell.

Maybe something to pay more attention to? If the application is meant to be used on a usb-stick, it's meaning is to use it where ever you want. Problem is that you never know what kind of OS / anti-virus you'll encounter...
So it would be started nicely if it works without any issue... Wacko

John T. Haller
John T. Haller's picture
Online
Last seen: 2 min 19 sec ago
AdminDeveloperModeratorTranslator
Joined: 2005-11-28 22:21
Please Report It

McAfee false positives can be very annoying, but it's not something we have any control over. Obviously, they're having a quality issue at the moment with their virus definitions. You can see in this VirusTotal analysis that it's only McAfee that's broken. McAfee has had issues in the past, like when it deleted bits of Windows and crashed PCs.

Sometimes, the impossible can become possible, if you're awesome!

StationMaster
Offline
Last seen: 14 years 2 weeks ago
Joined: 2008-12-30 14:49
PidginPortable.exe no longer deleted by McAfee

I just tried it again this morning, and McAfee DAT version 5921.0000 dated March 15, 2010 no longer detects the executable incorrectly.

Amarus
Amarus's picture
Offline
Last seen: 11 years 8 months ago
Joined: 2008-04-25 17:00
I'm here again to

I'm here again but this time to confirm that what StationMaster said is true. We can once more run the latest version of pidgin.

in_vino_veritas,_in_aqua_sanitas.

Log in or register to post comments