Summary:
The results of on-the-fly detection mismatches the results of manual scan.
Descriptions: Compiling a Hello World C program by GCC/MinGW, cause a virus alert (on-the-fly), and the executable is sent to the Quarantine zone. However, if the same program scanned by avast again, no virus is detected.
Reproduce:
- Install Avast! free (on PC, Windows 7)
- Install MinGW (bash, compiler)
- Edit a hello world program, call it “1.c”:
#include <stdio.h>
int main(void)
{
printf (“Hello world\r\n”);
return 0;
}
4) Edit Makefile (to make things easy):
1.exe: 1.o
gcc -g $< -o $@
-
type make
[Result 1: Virus detected by Avast!]
-
Do it again with avast! disabled. (1.exe will be generated)
-
Open a windows explorer, right click on 1.exe, and click on “Scan 1.exe” (by avast!, of course).
[Result 2: No Virus is detected]
This isn’t news, by any means.
It happens to me all the time. Avast flags a file as some virus, but right clicking and scanning the file doesn’t detect anything. I think it’s a long standing bug.
Version information:
Avast! free: most recent as of 2014/5/2 12:25 (+8:00 timezone)
MinGW gcc: 4.8.1
bash: 3.1.17(1)-release
make: GNU Make 3.81
Note: bash is to run make,
Note: gcc, bash, and make are installed in MinGW distribution, release-2013-10-04
I don’t know it is not new… However, this is a serious bug. Consider that if I am building a large software (example OpenCV library), and encounters numerous false alarms…
The best way to confirm that this is a long standing bug is by submitting a support ticket to Avast via https://support.avast.com/Tickets/Submit
Is the detection named Evo-gen or FilerepMalware.If so then its deliberately done.These 2 are backend detection tactics used only in on-execution scanning not during manual scans. ;D
As true indian say… and none of you give the vital info, what malware name does avast give that detection
Also test the file at www.virustotal.com ( if tested before, click new scan) and post link to scan result here