Photopospro

[WacoJohn]

PhotoPosPro_SetUp.exe is the setup file. It is 49,047 KB. It is obtained from CNET downloads. Immunet does not flag anything on the download but when you INSTALL it, Immunet comes up with a false positive.

 

Here is a link to download the file (I hope):

 

http://dw.com.com/redir?edId=3&siteId=4&oId=1770-20_4-0&ontId=20_4&spi=e595efbfee6ed8e4138f8e82f598ca28&lop=link&ltype=dl_dlnow&pid=11901183&mfgId=6252206&merId=6252206&pguid=lr76WgoOYJMAAE3XheIAAAB7&ttag=tdw_dltext;1&destUrl=http%3A%2F%2Fdownload.cnet.com%2F3001-2192_4-10264444.html%3Fspi%3De595efbfee6ed8e4138f8e82f598ca28

[sweidre]

PhotoPosPro_SetUp.exe is the setup file. It is 49,047 KB. It is obtained from CNET downloads. Immunet does not flag anything on the download but when you INSTALL it, Immunet comes up with a false positive.

Here is a link to download the file (I hope):

http://dw.com.com/re...38f8e82f598ca28

Hi WacoJohn,

CNET is really trying to have only clean files for downloading, so therefore your assumption, that PhotoPosPro_SetUp.exe is clean should be correct! I suggest, that you anyhow follow the main way (pinned by Anthony) to send an email to support@samples.immunet.com with the file PhotoPosPro_SetUp.exe compressed into a zip- file or into a 7z- file as an attachment for analysis. Within 2 hours you will get a reply (US Mountain Time Mon-Fri 9-5). Automatically a report (malware or false positive) will also be sent to the Immunet Community Cloud!

 

Your link above is correct! I clicked on it and when my Slimbrowser intended to download it, Immunet popped up a message box in the bottom right corner:

--------------------

Immunet

Warning!

X Threat Qurantined

PhotoPosPro_Setup[1].exe has been detected as W32.Damaged_File

Qurantine was successfull, would you like to

 

Yes No

--------------------

Note 01, that the sentence: "would you like to" was truncated (shortened) -> Another bug in Immunet 3.0.1.6112!!!

I clicked on "Yes" and looked into my quarantine:

Left column:

!-sign in an orange square PhotoPosPro_Setup[1].exe 2011-06-01 16:41:55

(I clicked on it and received in the right hand field the following info:

----------------------

Event Type

Qurantine Failed

Detection Name

W32.Damaged_File

File Path

J:\temp\Temporary Internet Files\Content.IE5\2L7HEK8Y\PhotoPosPro_Setup[1].exe

Date: 2011-06-01 16:41:55

-----------------------

Note 02, that "Quarantine Failed", because I clicked on "Yes" above!

Note 03, I had to type this text manually, because this text cannot be copied to clipbord for later pasting -> Another bug in Immunet 3.0.1.6112!!!

Note 04, that Detection is "W32.Damaged_File"!

Note 05, that I have personally in my setup moved Temporary Internet Files into J:\temp\

Note 06, that the file: "PhotoPosPro_Setup[1].exe" is provided with "[1]". We do remember this from before, don't we WacoJohn?

Note 07, that date & time is the proper Swedish time!

Cheers,

sweidre

PS. The file "PhotoPosPro_Setup[1].exe" (with or without [1] is completely gone from my computer! It is not in the path above or in the directory, where Slimbrowser should have downloaded it into! It is not in the quarantine of Emsisoft Anti_Malware neither! DS