False positiv AFTER last update 5 Min. ago

system · 2008-01-14T00:43:45.000Z

for those having the issue, just deactivate Avast during the download of Keepass, install it and reactivate Avast, as it has no issue with the program itself, only with the setup file.

oh I forgot, on Virus Total, PrevX also thinks Keepass 1.10 is a virus. That’s a false positive as well no question about that but there must be something in the structure of that file that bring those alerts, just like the Eicar file does ;D. I read some old versions of Keepass like 1.07 already gave false positive with anti-virus software.

system · 2008-01-14T01:21:03.000Z

That may work for the installation of Keepass but it won’t work for my library of freeware tools, most of which are open source and defiintely free of virii. Many of these are incorrectly being reported as ridden with w32 trojan. Given that i’ve had this happen before with avast! and with this same torjan alert, I seriously doubt their virus engineers would recognize w32 trojan if it reached up and bit them in the ass.

What we need are correct defs NOW.

system · 2008-01-14T01:31:49.000Z

Such as mIRC version 6.16

mIRC is safe but i get this message Win32.Trojan.

Please correct your database.

Regards

system · 2008-01-14T01:37:24.000Z

trolojik post:11:

Such as mIRC version 6.16

mIRC is safe but i get this message Win32.Trojan.

Please correct your database.

Regards

it’s getting worrying, as files wrongly detected get blocked by Avast, even when you answer “no action”. And deactivating the shield each time those files are needed is no solution.

system · 2008-01-14T07:31:53.000Z

TODAY we get on all systems same error.

windows\system32\user32.dll infected with Win32:Trojan-gen{other}.

is it correct that this is a false positive???

on friday all was okay.

system · 2008-01-14T07:41:38.000Z

on 2 systems we have moved the files to container from bootscan.

now the systems are in boot loop.

bad idea to move user32.dll

the wont start in protected mode.

i hope it is only false positive…

btw: how i can restore the user32.dll from container? system doesnt boot

system · 2008-01-14T08:25:41.000Z

i have checked my folder system32 against kaspersky online scanner.

(http://www.kaspersky.com/de/virusscanner)

no virus found

i hope it is a false…

system · 2008-01-14T10:23:05.000Z

SOLVED

http://forum.avast.com/index.php?topic=32669.msg273132#msg273132

in this thread it is discussed as a false poitive.

system · 2008-01-14T12:21:42.000Z

already the third update in less than 24 hours and Keepass setup file is still considered as a virus. My system is not affected by false positive detection of virii on system files so far.

system · 2008-01-14T12:49:27.000Z

Some others false positives with StaxRip 1.0.0.2 setup executable and VistaCodecPack (reset.exe), all reported as Win32:Trojan-gen (other)…

cf. http://planetdvb.net/staxrip/
http://shark007.testbox.dk/

Lisandro · 2008-01-14T13:27:05.000Z

Sensi23 post:18:

Some others false positives with StaxRip 1.0.0.2 setup executable and VistaCodecPack (reset.exe), all reported as Win32:Trojan-gen (other)…

It’s the false positive week. Enjoy. ;D
http://forum.avast.com/index.php?topic=32676
http://forum.avast.com/index.php?topic=32657
Talking seriously, hope they correct this soon 8)

system · 2008-01-14T13:33:37.000Z

as long as a couple of setup files are affected, it’s not a problem, but if some system files (like user32.dll) or program files start to be detected as well, then it’s more serious and would require a complete deactivation of Avast AV, at least until the database is good again. It hasn’t happened on my system so far (concerning windows files), but if it did I’d switch immediately to another antivirus.

Lisandro · 2008-01-14T13:37:18.000Z

Hermite15 post:20:

But if it did I’d switch immediately to another antivirus.

Well… you won’t find the perfect antivirus… Antivir has a lot of false positives and AVG has some from time to time.
For user32.dll, the better will be adding to the Exclusion list of Standard Shield.

system · 2008-01-14T13:46:11.000Z

After reading other reports on false positives in this forum I’m just worried that my OS could become unusable if other files were affected. By the way I’ve been on AVG for years and never had a false positive with it. But I’d rather stick to Avast now, as it’s obviously got many more advanced features compared to AVG. And I’m sure the issue with those false positives will be resolved soon.

Lisandro · 2008-01-14T13:50:22.000Z

Hermite15 post:22:

I’m just worried that my OS could become unusable if other files were affected.

Yes, that’s bad… hope they think on allowing access to Chest at boot time on version 5.

Hermite15 post:22:

I’m just worried that my OS could become unusable if other files were affected.

By the way I’ve been on AVG for years and never had a false positive with it.
[/quote]
I had, bad ones. Not so frequently, but the detection rate is not as high as other good antivirus.

Hermite15 post:22:

But I’d rather stick to Avast now, as it’s obviously got many more advanced features compared to AVG.

No doubt avast has more features…

Hermite15 post:22:

And I’m sure the issue with those false positives will be resolved soon.

They usually are very quick to solve false positives.

system · 2008-01-14T13:53:37.000Z

Thanks for your involvement in the topic Tech, I really appreciate your answers.

system · 2008-01-14T14:19:10.000Z

FALSE POSITVE against german user32.dll is solved by update VPS: 080114-1

fast work… good team at alwil…

system · 2008-01-14T15:18:41.000Z

as I just wrote in the topic I created yesterday about the same issue:
http://forum.avast.com/index.php?topic=32649.0
the latest update has solved the issue with Keepass Setup file. Good job.

system · 2008-01-14T15:39:33.000Z

THX AVAST TEAM for solving KeePass problem so fast. ;D

Greetz
Black Sheik

system · 2008-01-14T17:13:49.000Z

There are three tests for an AV solution:

How much the product blocks
How fast the product team responds to a Zero Day
How fast the product team responds when they screw up

You guys just passed the third test.

Well done.

Announcements