capture.com false positive? (PC)

Article View: comp.virus

Article #4298

#4298

From: Travis Gee
Date: Fri, 11 Dec 1992 19:27

18 lines
1095 bytes

In the analyse.doc that comes with f-prot v. 2.06a, it says that

>Currently the following programs are known to cause a false positive:
>
>DIR1.COM
>GBXIBMEL.EXE
>GRAPHICS.COM
>PC-CACHE.COM
>WORD.COM     (Microsoft Word)
>XTPRO.COM

I got one for graphics.com , alright, but also for qdcolor.com (a qdos
file), and capture.com (a Word5 file). The qdcolor.com warning says
that it contains code to search for other executable files: no
kidding! It's an installation device for the qdos user interface.
capture.com, however, 'modifies itself in a highly suspicious way...'
This wasn't my machine and I don't know Word5, so I don't have any
hunches about it.  Two more Type I's for the record, though!

Technical Details

Message-ID: <0014.9212151931.AA10887@barnabas.cert.org>

Path: arc1-ca.pugleaf.net!sparky!uunet!spool.mu.edu!yale.edu!jvnc.net!netnews.upenn.edu!netnews.cc.lehigh.edu!news

Show Full Headers

Complete Article Headers

Path: arc1-ca.pugleaf.net!sparky!uunet!spool.mu.edu!yale.edu!jvnc.net!netnews.upenn.edu!netnews.cc.lehigh.edu!news
From: tgee@alfred.ccs.carleton.ca (Travis Gee)
Newsgroups: comp.virus
Subject: capture.com false positive? (PC)
Message-ID: <0014.9212151931.AA10887@barnabas.cert.org>
Date: 11 Dec 92 19:27:03 GMT
Sender: virus-l@lehigh.edu
Lines: 18
Approved: news@netnews.cc.lehigh.edu