I wrote a horse racing handicapping program. For security purposes and for a free 10 day evaluation, the program connects to 129.6.15.28 ’ time-a.nist.gov Gaithersburg, Maryland’ to get the current date and writes it to the users hard drive. Every time the program is run during the evaluation, it checks the current date and if 10 days are up then it tells the user so.
When given an activation code, the user enters it and the program checks the code on the server and if the code is valid, it puts a text file on my server so that I know that the program was installed and writes to their hard drive that there is a valid license.
I have had two people tell me who use Avast say that Avast is telling them that there is a trojan with the software. Each time I redownload and check the software for viruses and there is none. The name reported is: Win 32: Trojan-gen.{upx!}
Can someone tell me why Avast would report it as a virus and maybe tell me how to avoid such a situation.
Kevin, most probably a false positive.
To know if a file is a false positive, please submit it to JOTTI or VirusTotal and let us know the result. If it is indeed a false positive, send it in a password protected zip to virus@avast.com
Please, mention in the body of the message why you think it is a false positive and the password used. Thanks.
VirusTotal and Jotti both have file size limits 10 and 15MB each.
As a workaround, you can add these files to the Standard Shield provider (on-access scanning) exclusion list.
Left click the ‘a’ blue icon, click on the provider icon at left and then Customize. Go to Advanced tab and click on Add button…
You can use wildcards like * and ?. But be carefull, you should ‘exclude’ that many files that let your system in danger.
After that, please, periodically check it - scan it into Chest, right clicking the file - there should still be a copy in the chest even though you restored it to the original location. When it is no longer detected as being infected then you can also remove it from the Exclusion list.
Maybe “Disney America” ;D did not allow you access there, but according to DrWeb’s hyperlink scanner the link is CLEAN.
"File size: 15674 bytes
I suggest that kevinper uploads to virustotal, then sends a FP-report to those vendors whose signatures falsely flag it, might be in the packers used.
No detections found with DrWeb link checker, it may be because of the multiple packers that is causing the hiccup.
If it is indeed a false positive, add it to the exclusions lists (Standard Shield, Customize, Advanced, Add and Program Settings, Exclusions) and Restore it to its original location, periodically check it (scan it in the chest), there should still be a copy in the chest even though you restored it to the original location. When it is no longer detected then you can also remove it from the Standard Shield and Program Settings, exclusions.
Send the sample to virus@avast.com zipped and password protected with password in email body and false positive/undetected malware in the subject.
Or you can also add the file to the User Files (File, Add) section of the avast chest where it can do no harm and send it from there (select the file, right click, email to Alwil Software). No need to zip and PW protect when the sample is sent from chest. A copy of the file/s will remain in the original location, so any further action you take can remove that.
He will be able to if he pauses (or terminates) the web shield provider, that will at least get it to his hard disk, where the standard shield may chirp in, but he will be able to choose no action and then add the file detected to the exclusions lists as previously mentioned.
Thank you. I will tell him. I went ahead and started scanning all the files in the program - after it is unpacked and installed - and Avast said they are all clean (according to Jotti’s).