ANSWERED McAfee Giving Trojan Warning for ORBX Light file...

[caseyfallen]

McAfee Giving Trojan Warning for ORBX Light file and has Quarantined.

The file is marked as a RDN/Generic.hra!ce
 

Virus File name: RDN/Generic.hra!ce!0017930F0747

Found in: Program Files/MicrosoftFiightSimulator/ORBX/Scripts
 

 

 

[Wolter van der Spoel]

ignore it, it's what we call a FALSE positive

Also advise is to exclude your main fsX / P3D folder from the AV proggy

make sure when installing FTX addons that the AV is switched off

Always rightclick and select Run as Adminstrator

[caseyfallen]

Thanks Wolter.

I knew it was not dangerous. The issue is that Mcafee is Quarantining it. I restore it and then it's removed again. I have been able to find exactly what it is. It's the manual Day/Night buttons to turn the street lights off and on. It was made a long time ago for the lights for freeware add on areas/airports.

Is there anyway ORBX can get it safe listed?

[Jay Kae]

That was safe listed ages ago, well requested to be safe listed, McAfee basically gave me the finger :|

Do yourself a favour and don't renew your license with them, go Kaspersky

[caseyfallen]

Jay! Huge fan of your work!

Dooley noted about the file! I will be letting them know my displeasure and if they don't fix it... they will lose a long time customer. 

[caseyfallen]

Hi, I contacted McAfee . They have a new process for submission. I will submit the file. I hope others will too. So to get this file removed from the DAT.

 

Here is the directions:

 

False Positive Submissions
If you think that a file has been falsely detected or incorrectly classified, follow this process to submit the sample to McAfee Labs.  

Email submissions
To submit a sample via email, zip the file (using the procedure described in Solution 1) and send it to McAfee Labs Virus Research at: 

virus_research@mcafee.com.

IMPORTANT: Prefix the email subject line with the word FALSE. For example, "FALSE: file being detected by McAfee."

Include the Product and version, DAT version, Engine version, and a short description (including any other relevant information regarding why you think the file has been incorrectly detected). You can find all of the product information inside your McAfee Security suite by clicking About.

Sample email:
 

Please review the submitted file as we believe this is a false detection.
Product: McAfee Security Center 12.8
DAT version: 6587
Engine: 5600
Description of issue: This file has been detected as malware, but is part of my game.

 

After the sample has been analyzed, one of the following occurs:

• The sample is considered clean. Detection is suppressed, and will be updated in the next DAT release.
• The sample is incorrectly classified. It will be reclassified, and detection will be updated in the next DAT release.
• Analysis of the file determines that the sample is properly detected. You will be notified of the results.

Common questions about false positives and false positive submissions:

As a customer, how can I prevent our files from being falsely detected in the future?
McAfee Labs gladly accepts samples into our Quality Assurance testing process where they are scanned with every DAT release to prevent false detections. 

In the past, I have used the keyword NOAUTO in the subject line when submitting samples via email. Is that keyword no longer being recognized?
NOAUTO, which prevents the auto response message, is still an accepted keyword. However, to quickly identify and process possible false detections, use the FALSE keyword as described above.
 

I submitted via GetSusp and sent an email to virus_research@mcafee.com, but have gotten no response. How long should I wait?

Response from this system is automated. McAfee advises that you wait for two to three business days, and if you do not see a response then, reply back to the original mail with NOAUTO in the subject line requesting assistance. This might require a human analyst to respond, and may take several days. 

[Jay Kae]

Haha, thanks but yes, that process I have gone through before but good luck getting someone to talk to you 

Maybe seeing you have a license with them, you have a better chance

[catmar]

Thanks Wolter.

I knew it was not dangerous. The issue is that Mcafee is Quarantining it. I restore it and then it's removed again. I have been able to find exactly what it is. It's the manual Day/Night buttons to turn the street lights off and on. It was made a long time ago for the lights for freeware add on areas/airports.

Is there anyway ORBX can get it safe listed?

John Mcafee himself says that he has had nothing to do with Mcafee anti-virus for the last fifteen years and he would and will not use it so draw your own conclusion.

[capt sl]

I missed seeing this thread. that's exactly what happened to mine as well.

 

mcafee quarantined it

[kendo]

I have managed to get round this problem as follows - Open MacAfee and click on "Navigation" on the right side of the screen then scroll down to "Quarantined and Trusted Items" - click on "Quarantined Items" - Select FTXLIGHTS_DAY.EXE and click "Restore" - Quickly click back to "Home" page and click on "Schedule and run scans" - then click on "Real Time Scanning" and then click "Excluded Files" - Click "Add File" - In the dialogue box scroll quickly to the ORBX directory in FSX and click on the FTXLIGHTS_DAY.exe entry and click "open". This should add it to the excluded file list and MacAfee will not quarantine it again. You need to be quite quick so you beat the realtime scan,(if you try turning off real time scan the option to exclude a file is greyed out). If you are using the Junction command to keep your ORBX folder on a different drive to FSX exclude the file in both ORBX folders as if the file is deleted from one folder it will disappear from the other too - I found that out the hard way.

Regards

Kendo