False positive virus alert with RibbonCustomizer setup program
I posted earlier that the setup program of RibbonCustomizer triggered a virus alert with some virus scanners (see report). Kaspersky, one of the affected virus scanners, just informed me that it was a false positive virus alert and that the problem will be fixed as soon as possible. I will keep updating this post as I receive more replys from other anti-virus vendors. RibbonCustomizer will be available again for download now.
Virus scanner that trigger false alerts:
- AntiVir 7.8.1.15, definitions from 2008.08.05 - confirmed as false positive, fixed with definitions from 2008.08.13
- Avast 4.8.1195.0, definitions from 2008.08.13
- F-Secure 7.60.13501.0, definitions from 2008.08.06 - confirmed as false positive, fixed with definitions from 2008.08.10
- Fortinet 3.14.0.0, definitions from 2008.08.05 - confirmed as false positive, fixed with definitions from 2008.08.11
- GData 2.0.7306.1023, definitions from 2008.08.06
- Ikarus T3.1.1.34.0, definitions from 2008.08.06 - confirmed as false positive, fixed with definitions from 2008.08.13
- K7AntiVirus 7.10.413, definitions from 2008.08.13
- Kaspersky 7.0.0.125, definitions from 2008.08.06 - confirmed as false positive, fixed with definitions from 2008.08.09
- Norman 5.80.02, definitions from 2008.08.05
- VBA32 3.12.8.2, definitions from 2008.08.05
- ViRobot 2008.8.8.1329, definitions from 2008.08.08
- Webwasher-Gateway 6.6.2, definitions from 2008.08.05 - fixed with definitions from 2008.08.13
I want to assure all of you that all files distributed here are always thoroughly checked for viruses before being made available.

August 9th, 2008 at 16:24
This ‘false positive’ alert is something very boring for thousand of truthful programmer like you. With certain you had the misfortune of your exe file has the same string of some of the more than 600,000 already existent virus
If you do something to change strings in your file, maybe the false alert go away. For example, in the two file versions below, the current DOCtoEXE file passed in VirustTotal but the DOCtoEXEold not in Ikkarus antivirus line. And there is not any difference in their codes and sizes; I only changed the color of three pixels (yes, three pixels!) of the icon from transparent to gray, almost imperceptive, and recompiled.
If you want to test, the current DOCtoEXE can download from this page:
http://cpap.com.br/orlando/DOCtoExeMore.asp?IdC=OrlmoreWin
and DOCtoEXEold directly from this broken link:
cpap.com.br/cd.asp?T=Test&F=DOCtoEXEold.exe
You can see that both have the same sizes and the same header info, but the icons have three different pixels above Word style W. Or be, due only three pixels you can have your truthful name, application or site accused of malware deliver.
August 24th, 2008 at 19:40
Patrick, I see your ppsted on Augusr 8th. Are you still around? I have sent you several emails because RC Pro stopped working in Word. I have also poted in the forum. Please respond.