Since this misidentification is to the seller's advantage , they appear to have no intention of improving the product's accuracy. This tragically-flawed detection method has been preserved through several version changes. File size is nowhere near an adequate means of trojan identification. The size of any program file is easily altered by a variety of means. Trojans are very frequently compressed to render them unrecognizable to virus scanners.
Some trojans are even random , a different size every time.
Lockdown will sound an alert, leap to the desktop, and declare to its user that it has stopped the attack. In fact these port scans, even when done by serious potential intruders, are harmless unless a trojan is already installed on the machine. Some have reported that Lockdown raised its port-watch alarms almost immediately after installation, which is unlikely to be coincidental. This presents the possibility that Paris or an accomplice may be contacting their machines after they install Lockdown, in order to to produce alarms which will worry the user and convince him that Lockdown is providing vital protection. My emails also raise the possibility that Paris may be scanning people's systems , possibly in advance of his contacts, to find those who may be trojan-infected or vulnerable to intrusion.