False Positive (Gnuplot)

Viruses and worms
1

Hello avastians,

I’m the lead programmer of GearCity, http://www.gearcity.info/
And we’ve had some problems with avast throwing a false positive for gnuplot.exe.

From GearCity.exe, we call gnuplot.exe via commandline which I believe throws a red flag in avast.
Avast deletes gnuplot, thus crashing GearCity anytime someone views a graph. Avast then later prevents gnuplot from being installed anytime we have a patch.

My programming/windows computer isn’t connected to the Internet, and only connects to my samba server when I need to pull down libs or uploads files. So I’m pretty sure gnuplot isn’t infected from my machines. To double check I ran a virus total scan of Gnuplot.exe: https://www.virustotal.com/en/file/5c226cf0b85cb2725b5cb8a55801de040c10d76f08577a5b047867da64045098/analysis/

gnuplot can be found here: http://www.gnuplot.info/

GearCity can be found here: www.gearcity.info/beta.html

And beta tester reports of problems with avast can be found here: http://www.ventdev.com/forums/showthread.php?tid=381

Any questions, feel free to ask. I need to get this resolved. :expressionless:

EDIT Just saw the contact info in another FP topic… I’ll try there as well. :wink:

Thank you,
Eric.B

2

i see you have already found it.

report FP here. http://www.avast.com/contact-form.php

3

Were zombie processes being detected that were left behind by it?

polonus

4

Sorry for the late reply. I teach classes in the afternoon.

I don’t see any zombie processes in taskman, tasklist, or wmic.

In the code I use WaitForSingleObject, which would fail if the process zombied. Thus throwing an error code. Which it doesn’t.

Thanks,
Eric.B