Possible False Positive?

[pondus]

First seen: 2007-07-25 19:47:35

Last seen : 2011-10-28 23:22:00

VT score 11/43

https://www.virustotal.com/file-scan/report.html?id=d77be60217d6d7ef240f65854b5e9874dc85ca9f68ba3316d9c966b98b626507-1322051225

Avira lab say

The file 'FFF-ReflexV2.exe' has been determined to be 'FALSE POSITIVE'.In particular this means that this file is not malicious but a false alarm.

Detection is removed from our virus definition file (VDF) with the version: 7.10.9.72.

ThreatExpert

http://www.threatexpert.com/report.aspx?md5=63894385b0a65b784530200ba0c00361

[shadowwar]

As this is a crack software, we do not evaluate cracks and keygen for safety.

[pondus]

I guess that is correct...that it is crack software

but should not detection be correct anyway....is it malicious or not ?...or only riskware/PUP...

at the moment it is detected as Trojan:Backdoor and Avira / avast say clean

[shadowwar]

They are often built with the same tools used to create malware so there are frequent FPs but cracks and keygens are also often malware. This is a generic detection that is triggered by the builder being used that is used for mostly malware.

[pondus]

well Norman lab seems to agree with MBAM....since it is crack...they detect it as crack

This file is the crack of a game software. So there is a security risk associated with it. Thus added detection.

FFF-ReflexV2.exe : Processed - Crack.G