Apparent false positive

Viruses and worms
1

Avast 4.6, Virus DB version 0517-0, 04/25/05, found what I believe to be a false positive. While searching file libexpat.dll, Avast reported finding “Win32:Trojan-gen. {Other}”. This DLL is part of the Graphviz distribution from AT&T.

I have had that file installed for several years and it’s never tripped a virus scanner yet. I’ve had no suspicious activity.

Since the version of Graphviz I had was several years old (v1.10), I decided to do a fresh download and compare the files. (The files are available from http://graphviz.org/Download..php ) When I saw that the current version was up to 2.2.1 I decided to just uninstall and upgrade. Once I had the new version installed I pointed Avast at the installation folder and it said it found the same virus in the same file.

Either it’s a false positive or Graphviz has been a silent trojan vector for an incredibly long time.

The Virus Report form didn’t have a space for comments or any way to indicate that it was (or appeared to be) a false positive, so I’m posting this on the forum.

Thanks for a great product that I’ve had no other problems with!

–Gary Pavek
Plano, Texas, USA

2

Hi

It is possible that it is false positive, but you should submit the file to Jotti and see what it says.

Jotti: http://virusscan.jotti.org

3

hi

i’ve got the same problem with the same version of Avast and the same file (libexpat.dll)

  • from the game Republic Commando…
  • and from Graphviz…
    but there was no problem before the last update…

Is exclusion of the directories a good solution ???
Is it truely a virus???

Thanks in advance

4

i’ve got an answer from Avast…
“it’s a false positive. It will be fixed today”
so i’m waiting for the fix :slight_smile: :wink: