Apparent false positive

Avast 4.6, Virus DB version 0517-0, 04/25/05, found what I believe to be a false positive. While searching file libexpat.dll, Avast reported finding “Win32:Trojan-gen. {Other}”. This DLL is part of the Graphviz distribution from AT&T.

I have had that file installed for several years and it’s never tripped a virus scanner yet. I’ve had no suspicious activity.

Since the version of Graphviz I had was several years old (v1.10), I decided to do a fresh download and compare the files. (The files are available from http://graphviz.org/Download..php ) When I saw that the current version was up to 2.2.1 I decided to just uninstall and upgrade. Once I had the new version installed I pointed Avast at the installation folder and it said it found the same virus in the same file.

Either it’s a false positive or Graphviz has been a silent trojan vector for an incredibly long time.

The Virus Report form didn’t have a space for comments or any way to indicate that it was (or appeared to be) a false positive, so I’m posting this on the forum.

Thanks for a great product that I’ve had no other problems with!

–Gary Pavek
Plano, Texas, USA

Hi

It is possible that it is false positive, but you should submit the file to Jotti and see what it says.

Jotti: http://virusscan.jotti.org

hi

i’ve got the same problem with the same version of Avast and the same file (libexpat.dll)

  • from the game Republic Commando…
  • and from Graphviz…
    but there was no problem before the last update…

Is exclusion of the directories a good solution ???
Is it truely a virus???

Thanks in advance

i’ve got an answer from Avast…
“it’s a false positive. It will be fixed today”
so i’m waiting for the fix :slight_smile: :wink: