Hi, during Update of AVPE i get the following warnign by avast on-acces…:
Sign of “Win32:Small-1700” has been found in “C:\Dokumente und Einstellungen\All
Users\Anwendungsdaten\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_44d253fa\engine\avewin32.dll” file.
reproducible with each update (today…) .
false positive, isn’t it…? someone else has this…?
a short search in avpe/avast-board: zip…
I use avast as On-Access, AVPE only on-Demand (AVPE-Guard service is off)
*
my recent HJT-log (overloaded, I know, but hopefully nothing nasty…?)
haven’t had much time recently for IT/security…
Logfile of HijackThis v1.99.1
Scan saved at 22:32:33, on 03.08.2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
(I trapped/moved the file with avast,
and got this from JOTTI):
File: avewin32.dll Status:
POSSIBLY INFECTED/MALWARE (Note: this file was only classified as malware by scanners known to generate more false positives than the average scanner. Do not consider these results definately accurate. Also, because of this, results of this scan will not be recorded in the database.)
MD5 1d79e357a5dcc4ed4d8ba2adc83ae266 Packers detected:
Scanner results
AntiVir
Found nothing
ArcaVir
Found nothing
Avast
Found Win32:Small-1700
AVG Antivirus
Found nothing
BitDefender
Found nothing
ClamAV
Found nothing
Dr.Web
Found nothing
F-Prot Antivirus
Found nothing
Fortinet
Found nothing
Kaspersky Anti-Virus
Found nothing
NOD32
Found nothing
Norman Virus Control
Found nothing
UNA
Found nothing
VirusBuster
Found nothing
VBA32
Found nothing
File has just been sent in to virus at avast dot com
Sorry not wanting to take this off-topic but how are you managing to get Antivir to work with avast many that have tried have failed to get it to work as a back-up scanner or vice versa without conflict ?
thanks for the tips…
I tried to try Virustotal yesterday, but the server queue of 30 min put me off…
(same just now…:
Your file “avewin32.dll” is queued in position: 398. Estimated start time is between 37 and 56 minutes.)
You don’t think that only one hit out of 15 is not a pretty sure indicatiopn of a false alarm…?
AVPE-analysts haven’t found anything in the file (surprise ;D or they wouldn’t have sent it out…)
You can submit a file by email and be emailed either the results saving you having to wait.
1 of 15 in Jotti is a good indication VirusTotal has 21 and using windows AV engines where some Linux AV engines might not detect the virus the windows ones might.
I had the same problem. Avewin32.dll would not update. I finally went into the Avast! on-access scanner->Standard Shield->Customize->Advanced and added the file’s download and runtime locations to the exclusion list there.
Also ran the Virus Total utility to find that Avast! is the only anti-virus program out of 27 that had a problem with this file. Great utility by the way, David!
With regard to getting Antivir working as an on-demand-only scanner along side of Avast!: I’m running Windows XP Home SP2, and I have my scheduler run a simple batch file whenever my computer starts up that deletes the avguard.exe from Antivir’s folder - a good option if you don’t like fiddling with the registry.
Yeah… I’ve tried a lot of systems and after all, AntiVir starts to mess the Windows Security Center… avast is not detected anymore, legacy drivers of Antivir started to be detected… :-
Well, my bad experience with this…
Yes, I’m also using AntiVir as a non-resident scanner and avast! detected Win32:Small-1700 this morning while AntiVir was updating.
I tried unsuccessfully to move the file to the chest three times but the file could not be found. I eventually opted to take no action and a subsequent avast! scan revealed no malware.
AntiVir 6.35.1.0/20060805 found nothing
Authentium 4.93.8/20060804 found nothing
Avast 4.7.844.0/20060804 found [Win32:Small-1700]
AVG 386/20060805 found nothing
BitDefender 7.2/20060806 found nothing
CAT-QuickHeal 8.00/20060804 found nothing
ClamAV devel-20060426/20060805 found nothing
DrWeb 4.33/20060805 found nothing
eTrust-InoculateIT 23.72.87/20060804 found nothing
eTrust-Vet 12.6.2324/20060804 found nothing
Ewido 4.0/20060805 found nothing
Fortinet 2.77.0.0/20060805 found nothing
F-Prot 3.16f/20060804 found nothing
F-Prot4 4.2.1.29/20060804 found nothing
Ikarus 0.2.65.0/20060804 found nothing
Kaspersky 4.0.2.24/20060805 found nothing
McAfee 4822/20060804 found nothing
Microsoft 1.1508/20060804 found nothing
NOD32v2 1.1694/20060805 found nothing
Norman 5.90.23/20060804 found nothing
Panda 9.0.0.4/20060805 found nothing
Sophos 4.08.0/20060805 found nothing
Symantec 8.0/20060805 found nothing
TheHacker 5.9.8.186/20060804 found nothing
UNA 1.83/20060804 found nothing
VBA32 3.11.0/20060804 found nothing
VirusBuster 4.3.7:9/20060805 found nothing
Not so much keen but it does have 27 different scanners and if it gets through that lot you would know one way or another and it does as you say look like an FP.
Sending the sample zipped and password protected, marked as a false positive, to virus @ avast.com as there is no false positive feed back from VirusTotal (or Jotti).
thx, I already did that, no reply so far, and the FP is still popping up every AVPE-Update.
I guess I just have to wait then, and disable avast while updating AVPE
The mentioned file (avewin32.dll) contains uncrypted samples of viruses - so I’m afraid the only solution is to put this file (or the whole AVPE folder maybe) into the list of Standard Shield exclusions.
Take No Action only ignores that instance, any further accesses or extractions will obviously cause avast to alert again. The exclusions is the only real option to avoid the repetitive alert.
Thanks igor,
for the info…
I even managed to make the exclusion work by using
*\avewin32.dll
(excluding the AVPE-Update/Temp folder
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic*
somehow didn’t work for me)
I think that there is a path character length restriction so the deeper the file is in the sub folders the more likely you are to hit the restriction. Unfortunately I don’t know what the character number is for the restriction.
:-