False positiv AFTER last update 5 Min. ago

system · 2008-01-14T00:23:20.000Z

BlackSheik post:1:

Hello @all,

please take a look at this Software. Can’t Download cause AVAST kill the file.

This is the site : http://keepass.info/download.html

That is the problem software : KeePass 1.10 (Windows Installer EXE). I’m sure that this is an false positiv.

The called virus is : “Win32:Trojan-gen {other}” or so.

Greetz
Black Sheik

Getting seriously tired of this. This AV has a serious hardon for W32 Trojans - and they’re ALL WRONG. PSPAad, HTTrack, various other open source projects - it spots all of them as Trojans. This is not the first time this nonsense has happened and it’s always with the same malware suspicion. I know they’re wrong because I can scan the same files with other products including Symantec and McAfee 9horrors!) and they come up CLEAN. The mess started with the last set of updates a couple of minutes ago.

I’d suggest the virus string engineers get their act together and test more comprehensively or I’ll be moving to antivir. I’d further suggest that a new crop of definition be releases with 60 minutes to remedy this mess.

NOT happy.

system · 2008-01-14T00:36:46.000Z

Tech post:4:

I use KeePass v2

wow, I just tried to download the V2 alpha: it’s a no go. Also detected as a virus, and Avast database has been updated after a rather unusual short interval this time, just a couple of minutes before I tried this download (and only 3 hours after the last update on Sunday evening (here in Europe).

system · 2008-01-14T00:38:22.000Z

It’s STILL screwed.

Try again boys but make it fast. Patience is at a premium here.

system · 2008-01-14T00:43:45.000Z

for those having the issue, just deactivate Avast during the download of Keepass, install it and reactivate Avast, as it has no issue with the program itself, only with the setup file.

oh I forgot, on Virus Total, PrevX also thinks Keepass 1.10 is a virus. That’s a false positive as well no question about that but there must be something in the structure of that file that bring those alerts, just like the Eicar file does ;D. I read some old versions of Keepass like 1.07 already gave false positive with anti-virus software.

system · 2008-01-14T01:21:03.000Z

That may work for the installation of Keepass but it won’t work for my library of freeware tools, most of which are open source and defiintely free of virii. Many of these are incorrectly being reported as ridden with w32 trojan. Given that i’ve had this happen before with avast! and with this same torjan alert, I seriously doubt their virus engineers would recognize w32 trojan if it reached up and bit them in the ass.

What we need are correct defs NOW.

system · 2008-01-14T01:31:49.000Z

Such as mIRC version 6.16

mIRC is safe but i get this message Win32.Trojan.

Please correct your database.

Regards

system · 2008-01-14T01:37:24.000Z

trolojik post:11:

Such as mIRC version 6.16

mIRC is safe but i get this message Win32.Trojan.

Please correct your database.

Regards

it’s getting worrying, as files wrongly detected get blocked by Avast, even when you answer “no action”. And deactivating the shield each time those files are needed is no solution.

system · 2008-01-14T07:31:53.000Z

TODAY we get on all systems same error.

windows\system32\user32.dll infected with Win32:Trojan-gen{other}.

is it correct that this is a false positive???

on friday all was okay.

system · 2008-01-14T07:41:38.000Z

on 2 systems we have moved the files to container from bootscan.

now the systems are in boot loop.

bad idea to move user32.dll

the wont start in protected mode.

i hope it is only false positive…

btw: how i can restore the user32.dll from container? system doesnt boot

system · 2008-01-14T08:25:41.000Z

i have checked my folder system32 against kaspersky online scanner.

(http://www.kaspersky.com/de/virusscanner)

no virus found

i hope it is a false…

system · 2008-01-14T10:23:05.000Z

SOLVED

http://forum.avast.com/index.php?topic=32669.msg273132#msg273132

in this thread it is discussed as a false poitive.

system · 2008-01-14T12:21:42.000Z

already the third update in less than 24 hours and Keepass setup file is still considered as a virus. My system is not affected by false positive detection of virii on system files so far.

system · 2008-01-14T12:49:27.000Z

Some others false positives with StaxRip 1.0.0.2 setup executable and VistaCodecPack (reset.exe), all reported as Win32:Trojan-gen (other)…

cf. http://planetdvb.net/staxrip/
http://shark007.testbox.dk/

Lisandro · 2008-01-14T13:27:05.000Z

Sensi23 post:18:

Some others false positives with StaxRip 1.0.0.2 setup executable and VistaCodecPack (reset.exe), all reported as Win32:Trojan-gen (other)…

It’s the false positive week. Enjoy. ;D
http://forum.avast.com/index.php?topic=32676
http://forum.avast.com/index.php?topic=32657
Talking seriously, hope they correct this soon 8)

system · 2008-01-14T13:33:37.000Z

as long as a couple of setup files are affected, it’s not a problem, but if some system files (like user32.dll) or program files start to be detected as well, then it’s more serious and would require a complete deactivation of Avast AV, at least until the database is good again. It hasn’t happened on my system so far (concerning windows files), but if it did I’d switch immediately to another antivirus.

Lisandro · 2008-01-14T13:37:18.000Z

Hermite15 post:20:

But if it did I’d switch immediately to another antivirus.

Well… you won’t find the perfect antivirus… Antivir has a lot of false positives and AVG has some from time to time.
For user32.dll, the better will be adding to the Exclusion list of Standard Shield.

system · 2008-01-14T13:46:11.000Z

After reading other reports on false positives in this forum I’m just worried that my OS could become unusable if other files were affected. By the way I’ve been on AVG for years and never had a false positive with it. But I’d rather stick to Avast now, as it’s obviously got many more advanced features compared to AVG. And I’m sure the issue with those false positives will be resolved soon.

Lisandro · 2008-01-14T13:50:22.000Z

Hermite15 post:22:

I’m just worried that my OS could become unusable if other files were affected.

Yes, that’s bad… hope they think on allowing access to Chest at boot time on version 5.

Hermite15 post:22:

I’m just worried that my OS could become unusable if other files were affected.

By the way I’ve been on AVG for years and never had a false positive with it.
[/quote]
I had, bad ones. Not so frequently, but the detection rate is not as high as other good antivirus.

Hermite15 post:22:

But I’d rather stick to Avast now, as it’s obviously got many more advanced features compared to AVG.

No doubt avast has more features…

Hermite15 post:22:

And I’m sure the issue with those false positives will be resolved soon.

They usually are very quick to solve false positives.

system · 2008-01-14T13:53:37.000Z

Thanks for your involvement in the topic Tech, I really appreciate your answers.

system · 2008-01-14T14:19:10.000Z

FALSE POSITVE against german user32.dll is solved by update VPS: 080114-1

fast work… good team at alwil…

Announcements