[hilander999]

LanguageID Finder.exe is exactly what it says.... a language id finder.
It's part of the Rocketdock distribution and is harmless. The only thing it does is tell you what numerical language ID your local system is using for language support.

This file exists in the plugin folder, which then gets copied to the bartpe folder at build time. If your AV software is stopping the file creation, then you will not see the real name of the executable, just the temp structure file name assigned by the builder at file assignment time. This is normal.

If you have system restore enabled, then it makes sense that your also going to find that file inside of a recent restore point.

This is a false positive.

Report this file to AVG as a false positive. It's normally only a couple hours for them to fix it.
You can also safely delete that file from your rocketdock plugin since its only used manually by a user who does not know what local ID there system is using.

[PanRatio]

McAfee-GW-Edition 6.8.5 (last update in 2009.11.26) found in "odk_images.dll" "Heuristic.LooksLike.Win32.Suspicious.C" This is False Positive.

What should I do?

[rdsok]

PanRatio, on 26 November 2009 - 03:01 AM, said:

McAfee-GW-Edition 6.8.5 (last update in 2009.11.26) found in "odk_images.dll" "Heuristic.LooksLike.Win32.Suspicious.C" This is False Positive.

What should I do?

Didn't you read the post just before yours where they were told to report it to the company that is making the false positive?

[wrinkin]

Gedrean, on 07 July 2009 - 10:42 AM, said:

Hi! I've been noticing a lot of false positive reports coming in where users are still using version 3.20 or even 3.0 of UBCD4Win.

When we made 3.50, we started a new strategy for eliminating false positives and avoiding "undesirable program detected" messages within UBCD4Win.
As a trial for 3.50, about 6 or 7 programs were enclosed in a special 7z wrapper to "cloak" them from antivirus programs.
Best part was, we discovered that these applications take up very little space in the RAMDrive, and can be easily removed afterwards, so this decreased over-all default install and build size as well!
Now, the reason we don't do this for the larger and more complex plugins is actually pretty simple: RAMDrive size. We can't assume the user has 200+ MB of extra RAM to shove into a RAMDrive so we can have the antivirus plugins extract out like this, but we'd like to put more and more of the small plugins into this format, as well as catch ANY and ALL false positives with this.

Now, of course, this means for official plugins we have to make sure they are truly virus-free and do what they say, but since this strategy will only be employed for official (read:included) plugins, we feel this is a decent approach to take.
But, this post isn't for me to self-aggrandize about how awesome this approach is

Now, on to the meat and potatoes:

WE NEED YOUR HELP!

What I'd like to request is that if you have a false positive WITH 3.50, NOT EARLIER VERSIONS, please post them to this thread!
That way, the thread can be noted indicating which false positives have or will be fixed in future versions, and we don't have to sift through a million posts about how 3.0 has a false positive with McAfee that we fixed a long time ago.

This is also a great thread you can check to see if the virus report you got was a false positive. If it exists in this list, it's a false positive!

Posts don't need to be big, or long, or convoluted.
All we need is which application did it (So if it says, for example, ipscan.exe, the program itself is IP Scan) or the path to the application, and which anti-malware program caught the false positive (McAfee, Avast, MalwareBytes, AdAware, Spybot, etc.)

We'll do the rest, and hopefully make version 3.6 have an even better default install, with more tools, less size, and NO FALSE POSITIVES! (we hope.)

Thank you for your assistance in this matter!

I just downloaded UBCD4WinV350.exe from mirror site # 1 (http://www.securitywonks.net/listing/view/3/UBCD-for-Windows). Saved to a folder on my desktop and before I installed, I scaned the folder with Kaspersky Internet Security 2010. Kaspersky found "Trojan-PSW.Win32.Mapler.cp" (x3) and completely deleted the UBCD4WinV350.exe file. I have a screen shot of Kaspersky, but, for one reason or another, I cannot upload the pic. I keep getting the error "The server returned an error during upload".

Is the file that Kaspersky found a "false positive"? .....or should I try to download the UBCD4WinV350.exe file from another mirror site? Anyhelp would be appreciated.