Wednesday, November 19, 2008

McAfee SiteAdvisor's slander

Some people reported that some version of McAfee virus scanner detects one of my software mailsend as Gaobot virus. The root of the probelm is McAfee SiteAdvisor. It falsely claiming that mailsend is a virus! They are basically ruining the reputation of my site http://www.muquit.com/, which solely exists (for more than 12 years) to serve the Internet community with free software I wrote. As yahoo uses McAfee SiteAdvisor software, my site shows up as all red flagged in search. It's a shame yahoo has become so clueless! Apparently it is nothing new, McAfee SiteAdvisor is notorious for flagging sites falsely. Google on it, you will see what I mean.

I scanned with Trend Micro PC-cillin v 15.30.1151, and McAfee's very own Viruscan Enterprise 8.0, Other people have reported they scanned with Norton Antivirus, ClamAV 0.94.1/8645, avast! v4.8 Home Edition and found mailsend is clean.

The site: http://www.siteadvisor.com/sites/muquit.com/downloads/6455549/ claims that mailsend modifies registry:

CHANGE  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
CHANGE TracesProcessed=dword:00000010
CHANGE TracesSuccessful=dword:0000000c

This is just insane!

mailsend does not have any code to mess with registry.

Here is my opinion on this:
Whoever reported that mailsend is a virus, was infected with Gaobot and mailsend was corrupted. I know the program is not corrupted and it has no code to mess with registry, so I think this explanation makes sense. It is also quite possible McAfee's software is just outright buggy.
If you have a better explanation, please post your comment.

If you are interested to verify, I am leaving the original file: mailsend1.15b5.exe.zip (available at the mailsend page).
MD5 sum: deb005aee615bbcae84fd9d87b8d6e8d

Check the bottom of the SiteAdvisor page and check the size nd MD5 sum to make sure you are dealing with the same file.

Please verify with your Virus scanner and post your comment, I would appreciate it!.

It's a shame McAfee accepts this kind claim without verifying themselves. If you use my software and if you are a user of MacAfee products, let MacAfee know about this problem and spread the word about the abuse and slander by MacAfee SiteAdvisor. I do not gain financially from my site but this kind of irresponsible behavior from MacAfee will certainly harm many online businesses.

10 comments:

Unknown said...

I'm with you.. similar problem. McAfee, no response from them. This is just awful. My business is being flushed down the tubes and I'm *really* suffering...

FridayChild said...

I want to thank you for mailsend, which I use regularly with satisfaction.
McAfee SiteAdvisor is shameful, and they have proven so multiple times.
Keep up the good work.

Jim Tisdall said...

Muhammed Muquit is one of the most
talented and honest and
hard-working and community-minded
programmers I've ever worked with.
Surely McAfee should repair this
error with apologies and other
corrective actions.
(I'm a research coordinator at
DuPont; author of two O'Reilly
books; former jobs include stints
at Bell Labs, Human Genome Project,
Fox Chase Cancer Center ... just to
underline that my opinion is
an informed one.)

MrChuck said...

We retired McAfee years ago after unending problems, including bloat, false positives, false negatives, and instability. I'm not the least bit surprised by this latest thing.

Avoid McAfee like swine flu.

Helen Hunt said...

I have been using your software and McAfee is also installed, yet have not noticed this problem. What this shows is that they are not consistent in their detection.

On another note, how comes you have not updated your site and blog in almost a year???

mm said...

I just noticed McAfee SiteAdvisor shows mailsend1.15b as 'virus free'. Why? The checksum is still the same, why suddenly it is 'virus free'? But I did not get any apology or explanation. Why did they mark my perfectly clean software as virus? Looks like they are above the law! No one can touch them!

Here is the link which shows malisend1.15b is clean now. Look at the checksum, it's the same.

http://www.siteadvisor.com/sites/muquit.com/downloads/6455549/

Anonymous said...

At my office we have stuff from McAfee they detect vncserver as a virus too, stupid guys, since we have been hit by a old virus we change it from micro trend. But use open source os and get rip of virus :))

BanditQuest said...

Glad to see false positives are gone.

To prevent virus scanner false positives I get a "second consult" from http://www.virustotal.com. They have a nice little utility you can put use via "windows sendto" which send them your file and you get a report showing analysis from over a dozen plus virus tools. I highly recommended for anyone who loves freeware.

The tool details here http://bit.ly/bGvQHl

Ragu Kattinakere said...

Dude,
I have been using your binary and its awesome. Thanks for that. No virus no nothing. Just perfect to send myself cron activated messages.
Regards
Ragu

Anonymous said...

Hi...

before i install this on my server, i did reserched on it lot, atleast i ended up by installing, trust me your software make my day happy.. thanks and keep it up doing good wrok...