dial/egroup.l a false positive???

[#1]

We have had several of our clients and many of our own computers allegedly infected with " dial/egroup.l" . Unfortunately, the Fortinet antivirus website has almost no information on this, and we don' t see anything on the other antivirus vendor' s websites with this name. From the point of Forticlient AV detecting the alleged bad stuff in countless DLLs, several programs, not surprisingly, won' t run. Browsers don' t work, and no Microsoft Office (2003) software runs. If we disable the Forticlient Realtime AV, then restart the computer in " safe mode with networking" and do a full scan on Trend Micro' s site, we get nothing detected. McAfee and others don' t detect anything. My suspicion is that this is a false positive. This " infection" is happening on far too many machines simultaneously, including many that are firewalled and behind a FG100/FG60 and never leave the office. Has anyone else experienced this? As I investigate this further, I' ll update this thread. Cheers, Chris

[#2]

Some further information on this issue. Machines experiencing alleged " virus" : * Forticlient virus definitions: 6.96 Machines not experiencing alleged " virus" : * Forticlient virus definitions: 6.94 I will update everyone as we learn more.

[#3]

Chris, I also have the problem, but just on certain machines even though all have the same 6.96 version of virus definitions. Ron

[#4]

I have now completed full online " safe mode with networking" system scans on Trend Micro, Panda AV, and Kaspersky and all show the system is completely clean. I have uploaded alleged infected files to multiple online vendors via the interface at http://virusscan.jotti.org/ and all vendors including Fortinet show no infection. Furthermore, disabling the " Realtime AV Protection" and forcing an update brings down version 6.97 and re-enabling the realtime protection does not have this problem. We further tested 6.95 and 6.96 and had this issue. All machines updated to 6.97 are fine. What testing does Fortinet actually do on these definitions before they' re unleashed on the world at large? This is the second time in recent history that their antivirus definitions have been buggy. This one was far worse because it was even detecting Forticlient DLLs as being infected, and prevented it from running. For us, this bug affected dozens of computers and resulted in countless hours of lost productivity. We' re seriously considering uninstalling the Forticlient AV component and recommending to our clients that they go back to McAfee or someone else. The status quo is absolutely unacceptable. Fortinet: are you listening??? Regards, Chris

[#5]

Interesting that there hasn' t been a reply to this. I' ll tell you what I found to work better: Disable hueristic scanning. That is what was popping off on MS Office 2003 on my machines.