Computer Associates - Move to DAT 6606 to avoid false positives

AV products use sophisticated pattern matching, MD5 hash totals, and other techniques to detect hundreds of thousands of different viruses.  As they can only use about 100 bytes of information per virus signature, sometimes letigimate software will fall into a matching pattern and it will be detected as a false positive.

False positives can occur occasionally with any AV product and when viruses are detected users should pay close attention and record the name of any viruses found as noted in the MSNBC article. Sometimes a later search at the AV companies website may highlight any false positives detected.  If it's a true malware incident, noting the virus name might be valuable to knowing whether any information was transmitted from the compromised PC.

Computer Associates apologize for False Positive
http://isc.sans.org/diary.html?storyid=6775
http://www.msnbc.msn.com/id/31853138/ns/technology_and_science-security/
http://www.ca.com/us/securityadvisor/newsinfo/collateral.aspx?cid=212102

QUOTE: Antivirus software cuts two ways. It's great at blocking known viruses, but it can sometimes misfire, mistakenly flagging clean files as malicious. That sends a computer into a tailspin trying to clean up stuff that's supposed to be on there. The problem can crash a computer, and fixing it can be a bear. An example emerged this week when users of antivirus CA Inc. watched as their machines warned of an infection and started quarantining files that turned out to be legitimate.