This morning I recieved a false positive for the virus Win32:WoW-JA using Avast! Home Edition 4.7. Tech support at Blizzard Entertainment was able to confirm the false positive on their own systems.
Any way to correct this error in Avast? I think it was just put out in the latest definition release.
You could also check the offending/suspect file at: VirusTotal - Multi engine on-line virus scanner I feel virustotal is the better option as it uses the windows version of avast (more packers supported) and there are currently 30 different scanners.
Or Jotti - Multi engine on-line virus scanner if any other scanners here detect them it is less likely to be a false positive. Whichever scanner you use, you can’t do this with the file in the chest, you will need to move it out.
If it is indeed a false positive, add it to the exclusions lists (Standard Shield, Customize, Advanced, Add and Program Settings, Exclusions) and Restore it to its original location, periodically check it (scan it in the chest), there should still be a copy in the chest even though you restored it to the original location. When it is no longer detected then you can also remove it from the Standard Shield and Program Settings, exclusions.
Also see False Positives, how to report it to avast! and what to do to exclude them until the problem is corrected.
The Blizzard Tech Rep I talked to said that he used clean files directly downloaded from the Warcraft site and scanned them with the latest version of Avast! Home. Avast detected a “virus” so they are calling it a false positive.
Only Avast! and Ikarus picked up anything on VirusTotal.com.
Avast 4.7.1029.0 2007.08.23 Win32:WOW-JA
Ikarus T3.1.1.12 2007.08.23 Trojan-PWS.Win32.WOW.rg
Virusscan.jotti.org results…
Avast Found Win32:WOW-JA
I’m going to assume that my Tech Rep was correct and forward this to the False Positives. Thanks.
it will be fixed… if you can send us the legal file catched by this detection, we’ll add it to our cleanset…
I suppose the user should send to virus (at) avast.com
In the message body, maybe, a link to this thread will help.
You can also zip the file with a password - virus will be good - and send it.