Quote:
Originally Posted by PB 
I cannot tell about Dr. Web but here is what I found about Kaspersky. The have set up a web site where you can check if a Mac has been infected by the Flashback/Flashfake trojan, based on its UUID. I did the check and my Macbook was found infected. But I know it is not since I already ran the available tools (command-line from f-secure and the Symantec utility) to check this out for myself. So, I am clean and Kasperksy insists that I am not. Two explanations come into mind:
(1) They are liars and their intention is to increase sales.
(2) Their methodology is fundamentally flawed.
If you have any other explanations I am very curious to hear them.
I cannot tell about Dr. Web but here is what I found about Kaspersky. The have set up a web site where you can check if a Mac has been infected by the Flashback/Flashfake trojan, based on its UUID. I did the check and my Macbook was found infected. But I know it is not since I already ran the available tools (command-line from f-secure and the Symantec utility) to check this out for myself. So, I am clean and Kasperksy insists that I am not. Two explanations come into mind:
(1) They are liars and their intention is to increase sales.
(2) Their methodology is fundamentally flawed.
If you have any other explanations I am very curious to hear them.
Here's some: (1) you entered your UUID incorrectly; (2) the tools and instructions from F Secure and Symantec are wrong, you are infected; (3) it's just an plain old false positive, i.e. an error by Kaspersky's online tool.
(3) is probably the most likely but it says more about your mindset that you would jump from having a single false positive to the conclusion that a widely known security vendor are "liars." And how would they increase "sales"? The Flashback removal tool they and other vendors offer are all free with no obligation to pay for anything else. You can choose to buy their paid solutions but you're free not to - use the Flashback tools and delete them and never deal with them again.
If I was as distrustful and quick to label folks as liars as you, I might question whether you actually got a false positive - all we have is your claim that Kaspersky's tool identified your computer as infected while the tools from F-Secure and Symantec did not. Maybe you're so keen and eager to "protect" Apple that you're lying. How's that for questioning someone's motives instead of addressing the content of their arguments?
But I take you at your word. All I'd say is that it's a massive leap to say a single false positive demonstrates the existence of a Big Lie to hookwink and scare Mac users worldwide. My blood work comes back from my doctor and if the results turn out to be a false positive, I hardly jump to the conclusion that my doctor, the lab and the pharmaceutical industry as a whole are engaged in a vast conspiracy to drive up medical spending. Your case appears to be a false positive, nothing more, nothing less. Your tiny bit of evidence doesn't support either of your conclusions. At most, it demonstrates Kaspersky's tool isn't perfect and makes mistakes. It hardly proves the counting methodology is "fundamentally flawed."
What I'm still waiting for is an explanation of HOW the methodology is so flawed that it can't be trusted at all - why doesn't counting the number of bots that check in with a command server as those bots are instructed to do by the trojan give you an accurate count of the size of the infection? If you have any explanation why this doesn't work - one that doesn't resort to charges of lying, which doesn't actually rebut or undermine the methodology but only attacks the integrity of the researchers - I am very curious to hear it.
