FORScan uses binary compression and encryption to reduce the binary size and protect the code. This technique is often used by virus/malware (and often using the same compression/protection system), so some antivirus may throw a false positive if signature matched. We have created this thread to provide information on this issue.
At this moment we have this problem with FORScan v2.3.29 - several anti-virus software throw alerts for it, including Microsoft WIndows Defender. We have submitted the false positive to Microsoft and Bitdefender. Microsoft have already updated their database, so false positive should gone in the next update. They recommend to clear Defnder cache this way:
We have removed the detection. Please follow the steps below to clear cached detection and obtain the latest malware definitions.
1. Open command prompt as administrator and change directory to c:\Program Files\Windows Defender
2. Run “MpCmdRun.exe -removedefinitions -dynamicsignatures”
3. Run "MpCmdRun.exe -SignatureUpdate"
Microsoft removed trojan false positive for v2.3.29 from Windows Defender, but now it finds "PUA:Win32/Presenoker" in it Other antivirus s/w like Bitdefender seem to simply ignore our request for EXE analysis.
So what now? Did I just waste $40.00 on a obd connector?
No you should be able to add the forscan as an exception to the anti virus programs or at least allow it to run
as if the anti virus finds the false positives they should quarantine and from there you should be able to choose what you
want the anti virus to do about it i.e allow it to run
then try reinstalling forscan
hope this helps and may resolve your problem (not gauaranteed as there a lot of anti virus programs)
this worked though for me with the windows security program.
foden
We have released v2.3.30 yesterday and tested it on Virustotal to make sure there are no false alerts. Here is the report:
Thank you very much for your great support, I would like to confirmed, forscan V2.3.30 is no problem about that. I can install and it's working fine from now.
Best Regards,