False positiv AFTER last update 5 Min. ago

system · 2008-01-13T23:10:17.000Z

Hello @all,

please take a look at this Software. Can’t Download cause AVAST kill the file.

This is the site : http://keepass.info/download.html

That is the problem software : KeePass 1.10 (Windows Installer EXE). I’m sure that this is an false positiv.

The called virus is : “Win32:Trojan-gen {other}” or so.

Greetz
Black Sheik

Lisandro · 2008-01-14T00:07:06.000Z

Yes, it’s a false positive. KeePass is safe. Hope they correct it soon.
You can disable WebShield while downloading and installing or, better, wait to install after they correct the false positive detection.

system · 2008-01-14T00:10:10.000Z

Hi Tech,

THX for the Info. Ok i wait i can download the software tomorrow or in 2 days im using the KeePass usb zip. So for the installer i can wait.

Greetz
Black Sheik

Lisandro · 2008-01-14T00:11:36.000Z

I use KeePass v2

system · 2008-01-14T00:15:26.000Z

Hi,

hehehe i wait when it comes as stable then “maybe” i change.
I dont like this Netframework what is needit for the 2

Greetz
Black Sheik

system · 2008-01-14T00:23:20.000Z

BlackSheik post:1:

Hello @all,

please take a look at this Software. Can’t Download cause AVAST kill the file.

This is the site : http://keepass.info/download.html

That is the problem software : KeePass 1.10 (Windows Installer EXE). I’m sure that this is an false positiv.

The called virus is : “Win32:Trojan-gen {other}” or so.

Greetz
Black Sheik

Getting seriously tired of this. This AV has a serious hardon for W32 Trojans - and they’re ALL WRONG. PSPAad, HTTrack, various other open source projects - it spots all of them as Trojans. This is not the first time this nonsense has happened and it’s always with the same malware suspicion. I know they’re wrong because I can scan the same files with other products including Symantec and McAfee 9horrors!) and they come up CLEAN. The mess started with the last set of updates a couple of minutes ago.

I’d suggest the virus string engineers get their act together and test more comprehensively or I’ll be moving to antivir. I’d further suggest that a new crop of definition be releases with 60 minutes to remedy this mess.

NOT happy.

system · 2008-01-14T00:36:46.000Z

Tech post:4:

I use KeePass v2

wow, I just tried to download the V2 alpha: it’s a no go. Also detected as a virus, and Avast database has been updated after a rather unusual short interval this time, just a couple of minutes before I tried this download (and only 3 hours after the last update on Sunday evening (here in Europe).

system · 2008-01-14T00:38:22.000Z

It’s STILL screwed.

Try again boys but make it fast. Patience is at a premium here.

system · 2008-01-14T00:43:45.000Z

for those having the issue, just deactivate Avast during the download of Keepass, install it and reactivate Avast, as it has no issue with the program itself, only with the setup file.

oh I forgot, on Virus Total, PrevX also thinks Keepass 1.10 is a virus. That’s a false positive as well no question about that but there must be something in the structure of that file that bring those alerts, just like the Eicar file does ;D. I read some old versions of Keepass like 1.07 already gave false positive with anti-virus software.

system · 2008-01-14T01:21:03.000Z

That may work for the installation of Keepass but it won’t work for my library of freeware tools, most of which are open source and defiintely free of virii. Many of these are incorrectly being reported as ridden with w32 trojan. Given that i’ve had this happen before with avast! and with this same torjan alert, I seriously doubt their virus engineers would recognize w32 trojan if it reached up and bit them in the ass.

What we need are correct defs NOW.

system · 2008-01-14T01:31:49.000Z

Such as mIRC version 6.16

mIRC is safe but i get this message Win32.Trojan.

Please correct your database.

Regards

system · 2008-01-14T01:37:24.000Z

trolojik post:11:

Such as mIRC version 6.16

mIRC is safe but i get this message Win32.Trojan.

Please correct your database.

Regards

it’s getting worrying, as files wrongly detected get blocked by Avast, even when you answer “no action”. And deactivating the shield each time those files are needed is no solution.

system · 2008-01-14T07:31:53.000Z

TODAY we get on all systems same error.

windows\system32\user32.dll infected with Win32:Trojan-gen{other}.

is it correct that this is a false positive???

on friday all was okay.

system · 2008-01-14T07:41:38.000Z

on 2 systems we have moved the files to container from bootscan.

now the systems are in boot loop.

bad idea to move user32.dll

the wont start in protected mode.

i hope it is only false positive…

btw: how i can restore the user32.dll from container? system doesnt boot

system · 2008-01-14T08:25:41.000Z

i have checked my folder system32 against kaspersky online scanner.

(http://www.kaspersky.com/de/virusscanner)

no virus found

i hope it is a false…

system · 2008-01-14T10:23:05.000Z

SOLVED

http://forum.avast.com/index.php?topic=32669.msg273132#msg273132

in this thread it is discussed as a false poitive.

system · 2008-01-14T12:21:42.000Z

already the third update in less than 24 hours and Keepass setup file is still considered as a virus. My system is not affected by false positive detection of virii on system files so far.

system · 2008-01-14T12:49:27.000Z

Some others false positives with StaxRip 1.0.0.2 setup executable and VistaCodecPack (reset.exe), all reported as Win32:Trojan-gen (other)…

cf. http://planetdvb.net/staxrip/
http://shark007.testbox.dk/

Lisandro · 2008-01-14T13:27:05.000Z

Sensi23 post:18:

Some others false positives with StaxRip 1.0.0.2 setup executable and VistaCodecPack (reset.exe), all reported as Win32:Trojan-gen (other)…

It’s the false positive week. Enjoy. ;D
http://forum.avast.com/index.php?topic=32676
http://forum.avast.com/index.php?topic=32657
Talking seriously, hope they correct this soon 8)

system · 2008-01-14T13:33:37.000Z

as long as a couple of setup files are affected, it’s not a problem, but if some system files (like user32.dll) or program files start to be detected as well, then it’s more serious and would require a complete deactivation of Avast AV, at least until the database is good again. It hasn’t happened on my system so far (concerning windows files), but if it did I’d switch immediately to another antivirus.

Announcements