Virus in Easy Gif Animator?

[davidp]

I've just installed the trial of Easy GIF Animator 4.02, and it seems to run fine. Sophos certainly isn't flagging it as infected any longer.

Perhaps they've finally fixed it? I'm running Sophos 6.5.3 with threat detection engine 2.43.0 and threat detection data 4.15

[knouse]

Here's the email I just sent Sophos support -

Martin:

Actually it hasn't been fixed.

I'm running v6.5.3 with threat detection engine 2.43.0 last updated Mar 13 at 5:51 am.

As a work around I'd excluded the c:\Program Files\Easy GIF Animator from On-Access scanning.

When I manually scan the directory Sophos finds the "virus".

Ditto for the new Easy GIF Animator Pro v4.

It's hurting Blumenthals Software's business. Chris Jocke sent it to you Jan 28. It's been six week. It's time to fix this for real.

You can read the support thread here
http://forums.blumentals.net/viewtopic.php?t=1907

Steve Knouse

-----Original Message-----
From: samplesus@sophos.com [mailto:samplesus@sophos.com]
Sent: Friday, March 09, 2007 4:52 AM
To: Steve Knouse
Subject: Re: [QAY-3GJK-KXWY] File sample submitted from the Sophos website

Please quote [QAY-3GJK-KXWY] in the subject line of any further
correspondence related to this query.

Hi Steve

please accept my apologies for the delay in getting back to you. The
file that you sent to us for analysis was indeed producing a
false-positive report which has been corrected. Please do not hesitate
to contact me if I can be of any further assistance.

Regards

Martin James Elliott
Technical Support Specialist, Sophos

Tel: 01235 559933
Web: http://www.sophos.com
Sophos - security and control

Sophos Plc, The Pentagon, Abingdon Science Park, Abingdon,
OX14 3YP, United Kingdom.

Company Reg No 2096520. VAT Reg No GB 348 3873 20.

[knouse]

Karlis:

Martin at Sophos replied to me asking for sample executables. I sent him links on my web site to executables for GIF Animator v3 and GIF Animator v4 Pro.

I included an edited copy of your last email to him, asked him to talked to you directly, gave him your email address (from your email) and phone number (from your web site) and asked him to give fixing the problem some priority.

I copied you on the email. Give him a call.

Steve

[knouse]

Martin James Elliott, Technical Support Specialist, Sophos, emailed me, "an IDE file (catche-a.ide) to correct this false-positive report has now been released on the Databank and our web site. "

After checking I have catche-a.ide I scanned both v3 and v4 Pro executables without finding a "virus".

It appears to be fixed.

BTW: This was Sophoos support item QAY-3GJK-KXWY. If you write them about it include the it in the subject line.

[Karlis]

Thanks!