The FP is because of an alert here -Injection Check
Suspicious Text before HTML
mzÿÿ¸////@øº´í!¸lí!this program cannot be run in dos mode.////$ïäsususurusuéusususu½////£xusu½£yusuluusurichsupelðkà^ô¸////@p@à0s´à p .textæ]^ ///.rdata¢pb@@.data¬¯t@à.n////data@à.rsrc àx@@ájl$zóâl$jàj$zóâl$hl$jpâuìì svw}ñwnèa~ggff»f~ ¹°ãó«àè#ðçej?/////úyãâÿmó«uìjr¾ìyó«j¾¸////yó«ôèbüèwej3ÿx2ûeàeäeèeì}üë}øeüï#ááeøáneðql è\ࡶ r@}eøtrfn+eà;áráàneôbÿuôz#}üq/////±è¶ãóèjóçç@ááèeøë5äànzq#}ü±è¶ãóèjóçç@ááè?øfëd^/////¾ sæeèàãs¾pèàsumeð èvàu5¶är@vneøâ+eà;áráÿfîè°ÿeüé^////]àëc¾è,àu]äë%s¾°èàu]èëeè]ìeìeäeèeà]àeäÿuøfüpèﶸ/////r@møéÿuøôs豶¬r@øeðmø|jxáàs0ìèø|ièøñùãiëóãø}pfpìèaøë#//////áü~qïèáàw///
quote from Web Security Test.
This is a typical false positive on a NSIS installer - it became flagged in the past as Adware Punisher, AVG and Kaspersky and Sophos flagged this new installer as trojan and found out later it was a false positive, so I think Norman will soon fix this fale positive.
So when we see
archive NSIS we have to blink twice before saying it is malcode
Damian
