Tored 1.0a Missed by Sophos but spotted by MacScan

The detections will be different for different products, as the algorithms are different.

In this case, either we're missing the sample, or MacScan is triggering a false-positive.

Would you please send it to me via https://secure.sophos.com/support/samples ?

Under company name, put "Requested by Andrew @ SophosLabs" - hopefully that will avoid it being filtered out.

OSX/Tored is a RealBasic app, so if MacScan is detecting it in a true JPEG file (not a .app pretending to be a .jpg via a double extension), it's likely a MacScan FP.

File submitted.  Thank you.

Received; it's a legit JPEG file with all the EXIF data included (I'll mark it DND).  The guys at SecureMac would probably appreciate a heads-up :)

Thanks Andrew.  

You'll mark it DND?  What does that mean?

I'll tell MacScan of their error.  Why would an algorithm pick one jpeg file from the hundreds it scanned?

Will you delete my file then?

Marked DND (do not distribute) means that it is flagged as possibly containing private information, and is not to be shared with other systems, including backup systems.  As a result, it is eventually purged from the filestore.  I"m not sure what the timeframe is on that last bit.