799980 - Kaspersky reports Nightly 19.0a1 10-10-2012 as a worm

Status: RESOLVED INVALID

(Firefox :: Untriaged, defect)

Description

[LT]

User Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:19.0) Gecko/19.0 Firefox/19.0
Build ID: 20121010030605

Steps to reproduce:

I upgraded to Nightly 19.0a1 10-10-2012 x64


Actual results:

Upon upgrade restart, Kaspersky stopped the program as a worm virus and deleted it.  This also happened when I went and d/l'd a fresh, whole, non-u/g copy from the FTP server and Kaspersky still saw it as a virus.


Expected results:

Nightly should have loaded normally.

Comment 1

[LT]

I again installed Nightly with Kaspersky unloaded from memory (and all its dependent files and services).  This time, the install was successful and Nightly loaded properly.  With Nightly running, I ran Kaspersky: no problem.  I shut Nightly down and restarted: no problem.  

The problem it saw was the Firefox executable and no other file.  Kaspersky "Proactive Defense Module" flagged the upgraded Nightly Firefox.exe as a Worm.  However, once it was installed when Kaspersky wasn't running, no virus/worm was detected by either the PDM or heuristic scans.

Comment 2

[Matthias Versen [:Matti]]

very likely a false positive.
I uploaded the current nightly builds to http://virustotal.com

The ZIP Version:
https://www.virustotal.com/file/2935c9f8ec2aec00f6cd750471d8e19aa21c9702601411d4b2cb7a91f5499599/analysis/1349885354/

The installer version:
https://www.virustotal.com/file/b34b7122e2de5f2634df8d845a8aab6e8cc34f4ebafab5f50150d5aefaf50bd3/analysis/

Comment 3

[Matthias Versen [:Matti]]

You got this only from a heuristic scan ?
In that case report this please to kaspersky as false positive

Comment 4

[LT]

No.  Not from Heuristic Scan.  From PDM--Proactive Defense Module.

I executed a SEPARATE heur. scan after I had re-installed Nightly with Kasp. unloaded.  That scan caused no problem.  The false positive came without a scan--it came immediately when I restarted Nightly after the upgrade to 19.0 with Kasp running.  It was not from a scan.

I'm sorry I didn't clarify thoroughly.

Comment 5

[Matthias Versen [:Matti]]

All files on the ftp are scanned before they get moved onto the ftp and virustotal shows that several scanners doesn't detect malware in those files.

Either the files get infected on your system or this is a false positive from Kaspersky and has to be reported to them.