Hi everybody,
I'm a novice NEURON user.
I have installed it on a Vista-Notebook. My Antivir-Guard keeps telling me that the bin\mos2nrn.exe is the trojan TR/Crypt.XPACK.Gen.
So far I told Antivir to ignore it. Now as the errror message pops up about every 2 hours, it's becoming annoying.
If anyone already came across this problem, or just has any Idea - please tell me how to handle it.
I'd be grateful for any suggestions.
Miem
my Antivir recognizes mos2nrn.exe as a trojan
-
ted
- Site Admin
- Posts: 6384
- Joined: Wed May 18, 2005 4:50 pm
- Location: Yale University School of Medicine
- Contact:
Almost certainly a false positive
This is the second such report that we have received about mos2nrn.exe. We have
examined and tested this file extensively, and found no evidence that mos2nrn.exe is any
kind of malware. Among other things, we have performed multiple tests, on different PCs
under different versions of MS Windows, using various versions and updates of the
corporate edition of Symantec Antivirus, and found no evidence of anything wrong with
the file.
We believe that Antivir-Guard is generating a "false positive" complaint about
mos2nrn.exe. All antivirus software is susceptible to making false positive complaints
about programs or files that are absolutely not malware. Avira's own WWW site
discusses the possibility, and like all responsible antivirus software developers,
they ask users to submit samples of suspected false positives.
Which is what I did two weeks ago today, after our first report of this from another NEURON
user. But I sent it as an attachment to an email msg, so maybe it got lost. Today I sent
it again, but this time used their WWW-based form
http://analysis.avira.com/samples/index.php
(You might wish to do the same.)
When they get back to me with a result, I will post it on this discussion thread.
And any other NEURON user who uses a different antivirus program under MSWin is
invited to test mos2nrn.exe themselves with their own AV software, and report what they
find in a message on this discussion thread.
examined and tested this file extensively, and found no evidence that mos2nrn.exe is any
kind of malware. Among other things, we have performed multiple tests, on different PCs
under different versions of MS Windows, using various versions and updates of the
corporate edition of Symantec Antivirus, and found no evidence of anything wrong with
the file.
We believe that Antivir-Guard is generating a "false positive" complaint about
mos2nrn.exe. All antivirus software is susceptible to making false positive complaints
about programs or files that are absolutely not malware. Avira's own WWW site
discusses the possibility, and like all responsible antivirus software developers,
they ask users to submit samples of suspected false positives.
Which is what I did two weeks ago today, after our first report of this from another NEURON
user. But I sent it as an attachment to an email msg, so maybe it got lost. Today I sent
it again, but this time used their WWW-based form
http://analysis.avira.com/samples/index.php
(You might wish to do the same.)
When they get back to me with a result, I will post it on this discussion thread.
And any other NEURON user who uses a different antivirus program under MSWin is
invited to test mos2nrn.exe themselves with their own AV software, and report what they
find in a message on this discussion thread.
-
ted
- Site Admin
- Posts: 6384
- Joined: Wed May 18, 2005 4:50 pm
- Location: Yale University School of Medicine
- Contact:
Definitely a false positive
As I suspected, this was merely a false alarm. Here's the body of the email that I just
received from Avira:
1. All antivirus software is susceptible to generating "false positive" results.
2. If your favorite antivirus software says that some file abc that is part of NEURON has
a virus or is a trojan or whatever, please contact us immediately to tell us:
--the name of the file and the release of NEURON that you are using
--the operating system you are using
--the name and version number of your antivirus program, and--if it's easy to find out--
the date, version number, or name of the latest "virus definition file" that it is using
We will run our own tests, and will contact the company/developers of your antivirus
software to find out if it's just a false positive (you may wish to do this too).
received from Avira:
The bottom line:Dear Sir or Madam,
Thank you for your email to Avira's virus lab.
Tracking number: INC00140683.
We received the following archive files:
File ID Filename Size (Byte) Result
3824312 mos2nrn.zip 10.06 KB OK
A listing of files contained inside archives alongside their results can be found below:
File ID Filename Size (Byte) Result
3824313 mos2nrn.exe 21 KB FALSE POSITIVE
Please find a detailed report concerning each individual sample below:
Filename Result
mos2nrn.exe FALSE POSITIVE
The file 'mos2nrn.exe' has been determined to be 'FALSE POSITIVE'. In particular this means that this file is not malicious but a false alarm. Detection will be removed from our virus definition file (VDF) with one of the next updates.
Alternatively you can see the analysis result here:
http://analysis.avira.com/samples/detai ... tid=140683
An overview of all your submissions can be found here:
http://analysis.avira.com/samples/detai ... fLkvfOMhyq
Please note: The detection of Spy/Adware is not available in the product "AntiVir PersonalEdition Classic". Please address specific questions to support@avira.com
Kind regards
Avira Virus Lab
---------------------------------------------
Avira GmbH
Lindauer Str. 21, D-88069 Tettnang, Germany
Phone: +49 (0) 7542-500 0
Fax: +49 (0) 7542-525 10
Internet: http://www.avira.com
CEO: Tjark Auerbach
Headquarter: Tettnang
Commercial register: AG Ulm HRB 630992
---------------------------------------------
1. All antivirus software is susceptible to generating "false positive" results.
2. If your favorite antivirus software says that some file abc that is part of NEURON has
a virus or is a trojan or whatever, please contact us immediately to tell us:
--the name of the file and the release of NEURON that you are using
--the operating system you are using
--the name and version number of your antivirus program, and--if it's easy to find out--
the date, version number, or name of the latest "virus definition file" that it is using
We will run our own tests, and will contact the company/developers of your antivirus
software to find out if it's just a false positive (you may wish to do this too).