False positive: CTWL2STI.DLL

Avast Free Antivirus / Premium Security
1

This dll is detected as containing sample of the Win32:Agent-CME [Trj].

It is in fact, just one of the driver of my Canon A40 digital camera.

Another Anti-virus (AVG Free Edition) does not detect anything.

Reinstalling the program from my original Canon CD still triggers a detection by avast!

I am then 99.99999% sure this is a false positive.

I tried to put the file in the ignore list but to no avail.

What am I suppose to do ?

Cat

2

Zipped and sent to virus@avast.com

Cat

3

Scanned at VirusTotal:

Complete scanning result of “CTWL2STI.DLL”, received in VirusTotal at 11.02.2006, 21:35:52 (CET).

Antivirus Version Update Result
AntiVir 7.2.0.37 11.02.2006 no virus found
Authentium 4.93.8 11.02.2006 no virus found
Avast 4.7.892.0 11.02.2006 Win32:Agent-CME
AVG 386 11.02.2006 no virus found
BitDefender 7.2 11.02.2006 no virus found
CAT-QuickHeal 8.00 11.02.2006 no virus found
ClamAV devel-20060426 11.02.2006 no virus found
DrWeb 4.33 11.02.2006 no virus found
eTrust-InoculateIT 23.73.43 11.02.2006 no virus found
eTrust-Vet 30.3.3174 11.02.2006 no virus found
Ewido 4.0 11.02.2006 no virus found
Fortinet 2.82.0.0 11.02.2006 no virus found
F-Prot 3.16f 11.01.2006 no virus found
F-Prot4 4.2.1.29 11.02.2006 no virus found
Ikarus 0.2.65.0 11.02.2006 no virus found
Kaspersky 4.0.2.24 11.02.2006 no virus found
McAfee 4887 11.02.2006 no virus found
Microsoft 1.1609 11.02.2006 no virus found
NOD32v2 1.1850 11.02.2006 no virus found
Norman 5.80.02 11.02.2006 no virus found
Panda 9.0.0.4 11.02.2006 no virus found
Sophos 4.10.0 10.26.2006 no virus found
TheHacker 6.0.1.111 11.02.2006 no virus found
UNA 1.83 11.02.2006 no virus found
VBA32 3.11.1 11.02.2006 no virus found
VirusBuster 4.3.15:9 11.02.2006 no virus found

Aditional Information
File size: 167936 bytes
MD5: eb0176d939ee87083e954b9569403eb4
SHA1: 6291dece6d5720efe68d393c2d9fb8fcbcd017f6

Avast is now disabled on my machine until the next update. Oh well…

Cat

4

when u say the “ignore list” did you also find the exclusion list in standard sheild provider as this is the one which would be most active.

im sure Avast! is copping plenty for all the false positives they are having lately but its the price of improved detections and hopefully it will improve .

5

For sure this is not necessary (and not save either…).
As a workaround, add the false positive (which seems in this case…) to the Standard Shield exclusion list.
Left click the ‘a’ blue icon, click on the provider icon at left and then Customize. Go to Advanced tab and click on Add button…
You can use wildcards like * and ?. But be carefull, you should ‘exclude’ that many files that let your system in danger.

6

Since the last update the previous file is not seen as a potential thread anymore, but another one has just popped up, always in my folder containing Canon drivers and applications.

Again, a scan with AVG is inconclusive, as is an online search with Online Malware Scan or VirusTotal:

Online Malware Scan:

File: RemoteCapture.exe
Status:
POSSIBLY INFECTED/MALWARE (Note: this file was only classified as malware by scanners known to generate more false positives than the average scanner. Do not consider these results definately accurate. Also, because of this, results of this scan will not be recorded in the database.)
MD5 abeeb79821311a5cbfb23c0d0e7fb0a0
Packers detected:

Scanner results
AntiVir
Found nothing
ArcaVir
Found nothing
Avast
Found Win32:Caca
AVG Antivirus
Found nothing
BitDefender
Found nothing
ClamAV
Found nothing
Dr.Web
Found nothing
F-Prot Antivirus
Found nothing
Fortinet
Found nothing
Kaspersky Anti-Virus
Found nothing
NOD32
Found nothing
Norman Virus Control
Found nothing
VirusBuster
Found nothing
VBA32
Found nothing

VirusTotal scan:

Complete scanning result of “RemoteCapture.exe”, received in VirusTotal at 11.04.2006, 23:50:45 (CET).

Antivirus Version Update Result
AntiVir 7.2.0.37 11.03.2006 no virus found
Authentium 4.93.8 11.04.2006 no virus found
Avast 4.7.892.0 11.03.2006 Win32:Caca
AVG 386 11.04.2006 no virus found
BitDefender 7.2 11.04.2006 no virus found
CAT-QuickHeal 8.00 11.04.2006 no virus found
ClamAV devel-20060426 11.04.2006 no virus found
DrWeb 4.33 11.04.2006 no virus found
eTrust-InoculateIT 23.73.45 11.03.2006 no virus found
eTrust-Vet 30.3.3176 11.03.2006 no virus found
Ewido 4.0 11.04.2006 no virus found
Fortinet 2.82.0.0 11.04.2006 no virus found
F-Prot 3.16f 11.04.2006 no virus found
F-Prot4 4.2.1.29 11.04.2006 no virus found
Ikarus 0.2.65.0 11.03.2006 no virus found
Kaspersky 4.0.2.24 11.04.2006 no virus found
McAfee 4888 11.03.2006 no virus found
Microsoft 1.1609 11.04.2006 no virus found
NOD32v2 1.1853 11.03.2006 no virus found
Norman 5.80.02 11.03.2006 no virus found
Panda 9.0.0.4 11.04.2006 no virus found
Sophos 4.10.0 10.26.2006 no virus found
TheHacker 6.0.1.112 11.03.2006 no virus found
UNA 1.83 11.03.2006 no virus found
VBA32 3.11.1 11.04.2006 no virus found
VirusBuster 4.3.15:9 11.04.2006 no virus found

Aditional Information
File size: 614400 bytes
MD5: abeeb79821311a5cbfb23c0d0e7fb0a0
SHA1: 47e801da3b2512caa7a22d1420cbe8e7f44011ce

Why has the sensibility of avast gone FUBAR recently ? ???

Cat