False alarm & Virustotal

Viruses and worms
1

We distribute a file which Avast (current virus Definition) defines as possible thread
Win32:Evo-gen [Susp]

But when I upload to virustotal then all Anti-Virus programs (including Avast) say ‘file not defected’.
I don’t understand this.

The file is signed.

The only negative I find on Virustotal is

Created mutexes RasPbFile (failed)

Opened mutexes
RasPbFile (successful)

I tried to Google for “RasPbFile & mutex” but I couldn’t find any helpful information. Perhaps you could help me to prevent more false positives (if that was the reason for it)

2

You can report a possible FP here: https://www.avast.com/contact-us.php?subject=VIRUS-FILE

3
We distribute a file which Avast (current virus Definition) defines as possible thread Win32:Evo-gen [Susp]
Win32:Evo-gen [[b]Susp[/b]] = [b]Suspicious[/b]
But when I upload to virustotal then all Anti-Virus programs (including Avast) say 'file not defected'. I don't understand this.
Not always, but some of these suspicious detections are triggered by on access only ..... as it seems to be in your case
4

Avast is triggering the false postive while the setup process.
So it cannot/shouldn’t be an on access.

5

If you run setup it means you are accessing the file, which means avast can detect it on access.

6

But then i do not understand what Pondus wanted to say.
While the Setup the file will be decompressed and copied. If this is what Pondus meant with accessing - then how does Virusttotal NOT Access the file?

By the way:
When I disable Avast and install my Software then after a restart (which enables Avast again) Avast is moving the Software to the quarantine.
I did not start or touch the *.exe in that moment.
What does the offline Version of Avast do different than the online one on Virustotal?!

If I cannot trust the results on Virustotal - whom I should still trust? A Anti-Virus Software which cannot decide between ‘Yes’ & ‘No’?!

7

VT only scans the files, it does not check “on access”.
What is detected also depends on the settings in avast (or any other av).

8

Avast fixed the problem - thanks!

I also have to apologize for some wrong information I wrote here in the forum. Yes you were right the file was accessed while the setup since we set some parameters depending on the choices the customer made. And so the setup runs the program.
But because of the stress we had with many customers calling I totally forgot. Sorry!

9

No worries, we all forget sometimes something.
Good to hear the problem is solved.

10

+1 :slight_smile: