Avast 5.0.394 is detectig Inifox 1.2 as Win32:Malware-gen (FP)

Inifox 1.2 is a legitime program developed to make fire fox faster by the people of infospyware, they help a lot of people to get rid of malware and they recomend Avast Free antivirus.

http://www.infospyware.com/herramientas/inifox/

I guess this is a False Positive.

I’m sending the file thru Avast to Alwill team so they can verify it.

rm

I forgot to add this.

Hi friend! Well, i have submited the sample to avast, lets see if they fix the FP. Take care!

Cazoza,
I did too form the virus chest… hope they will fix it soon since it really since a FP to me

Since “we make Firefox faster” is an obvious nonsense-line meant to lure in foolish users, I’d tend to believe that it’s an accurate positive.

Why not conform the detection or otherwise using virustotal whilst waiting:
Check the offending/suspect file at: VirusTotal - Multi engine on-line virus scanner and report the findings here the URL in the Address bar of the VT results page. You can’t do this with the file securely in the chest, you need to extract it to a temporary (not original) location first, see below.

  • Create a folder called Suspect in the C:\ drive, e.g. C:\Suspect. Now exclude that folder in the File System Shield, Expert Settings, Exclusions, Add, type (or copy and paste) C:\Suspect* That will stop the File System Shield scanning any file you put in that folder. Now enter the chest again and Extract the file to the Suspect folder and upload it to VT.

Seeing as the OP is not around I sent the file (entire zip file) into VirusTotal.

Of note, avast 5.0.377 also detects this as Win32:Malware-gen, so I had to disable the shields for a minute to download it, but was very sure to not run it (or even decompress it)

Here are the results:

https://www.virustotal.com/analisis/a281596d99fed5ec2d33947e1cdeb4f20a4009128581ad9a50720c950a87a716-1264726350

It appears to be suspicious file, detected by other Antivirus too

Well the detections are either generic (.gen or -gen), or Heuristic (Sus, Suspect or Heur.), So it was correct to send it to avast for further analysis.

People who made this little program to make firefox run faster said in that page that other antivirus programs started to detect it as malware and that they were letting the antivirus makers know that this is a legitim program.

As far as I know when I was running Avast 4.8 never bother me saying it was malware till now my sister had Avira before I installed Avast 5 and never poped up saying it was malware and that little program really made firefox start faster.

I saw the virustotal results I still refuse to think it is true, hope Avast team get back to us saying if it is really malware or not.

Tks.rm

The virustotal results should be used as a guide, as I have mentioned in the past, Generic or Heuristic detections are more prone to misdetection.

So we/you we will have to await the results of the avast analysis - Periodically scan the file from inside Chest, after VPS updates, when it is no longer detected you can restore the file/ to their original location/s.

Is the procedure the same for sending suspicious files for testing the same in version 5 as for version 4? Can you use the E-Mail Subject Line: Suspected File Test or False Positive Test and submit it as a zip file to:

virus@avast.com

Jack

As I said in another topic, the email process is a pain in the rear as you have to zip and password protect the file to prevent possible intercept on route to avast. The subject is crucial as they are filtered so if you just ad-lib it then it may not be filtered and lose priority (false positive or undetected malware being the two general terms in the subject).

Emails is a bit prehistoric especially so when there is an integrated means of uploading the suspect/fp files from the chest and the form completion avoids any ambiguity.