False Positive?!?!?? HL.EXE HLDS.EXE Half-life game files deleted by Avast.

system · 2008-01-15T23:30:17.000Z

So today when I started up a game which uses the hl.exe and hlds.exe half-life executable and half-life dedicated server executables respectively.
Avast promptly detected it as a Win32:Steam-AS [trj] Trojan Horse and for some reason deleted it without any of my input.
Here is a log of the multiple times it detected the executables as viruses.

1/15/2008 4:59:38 PM SYSTEM 1444 Sign of “Win32:Steam-AS [trj]” has been found in “D:\program files\steam\steamapps\itismario\day of defeat\hlds.exe” file.
1/15/2008 5:02:46 PM SYSTEM 1444 Sign of “Win32:Steam-AS [trj]” has been found in “D:\program files\steam\steamapps\itismario\day of defeat\hl.exe” file.
1/15/2008 5:03:34 PM SYSTEM 1444 Sign of “Win32:Steam-AS [trj]” has been found in “D:\program files\steam\steamapps\itismario\day of defeat\hl.exe” file.
1/15/2008 5:03:38 PM SYSTEM 1444 Sign of “Win32:Steam-AS [trj]” has been found in “D:\program files\steam\steamapps\itismario\day of defeat\hlds.exe” file.
1/15/2008 5:06:35 PM SYSTEM 1444 Sign of “Win32:Steam-AS [trj]” has been found in “D:\Program Files\Steam\steamapps\itismario\day of defeat\hlds.exe” file.
1/15/2008 5:17:43 PM SYSTEM 1444 Sign of “Win32:Steam-AS [trj]” has been found in “D:\Program Files\Steam\steamapps\itismario\half-life\hl.exe” file.
1/15/2008 5:22:26 PM SYSTEM 1444 Sign of “Win32:Steam-AS [trj]” has been found in “D:\Program Files\Steam\steamapps\itismario\half-life\hlds.exe” file.
1/15/2008 5:22:57 PM SYSTEM 1444 Sign of “Win32:Steam-AS [trj]” has been found in “D:\Program Files\Steam\steamapps\itismario\counter-strike\hlds.exe” file.
1/15/2008 5:22:59 PM SYSTEM 1444 Sign of “Win32:Steam-AS [trj]” has been found in “D:\Program Files\Steam\steamapps\itismario\counter-strike\hl.exe” file.

Is there a way to specifically stop Avast from deleting these certain files?
I would really like for Avast to mediate these false positives, as every single trace of the games’ critical files are now lost and gone.

system · 2008-01-15T23:54:18.000Z

Win32:Steam-AS [trj]

is a false positive,
PLZ fix it.

Lisandro · 2008-01-16T00:07:51.000Z

Man, it’s becoming boring… why so much false positives these days?

system · 2008-01-16T01:18:57.000Z

I’m having the exact same problem. I searched it on google and seen other people are as well, some in different languages as well. But all seem to be having the problem starting today, or been posting about the problem today. I don’t know much about viruses but read some stuff about windows viruses that do something with files that start with “hl” and are bigger then 4 kb but smaller then 2mb and just spread throughout your system and network. It was on the symantec website search tool i searched hl.exe and got a different windows virus then the one that Avast’s WIN32:Steam-AS [trj] definition. Here is the link to symantic search that i read http://www.symantec.com/security_response/writeup.jsp?docid=2003-020612-1237-99&tabid=2.At first i was like right my hl.exe is a virus but after reading that symantec thing, I’m not sure. Again I know nothing about viruses and what they can do I really don’t want to reformat just so I know nothing is wrong, I’m almost positive that this is wrong or a false positive because i deleted the files and steam replaces them when you try to execute a game that needs those files. It still detects the new files steam downloaded as a virus, I’m probably just gunna tell avast to ignore those files but i would like someone who knows what they are talking about to confirm that this is no threat or give some input toward the problem. thanks

system · 2008-01-16T02:12:38.000Z

I would really like an update for this as well, I haven’t touched my steam files in a few days and I wanted to run CS today, and avast was like “nah thats ok, bad stuff is going on here we gotta fix first” and I was like omg why avast!?

Avast decided to tell me “!!!”

system · 2008-01-16T02:36:13.000Z

Hey, yeah, I’ve never had to use these forums other then now. I’m running into this problem as well. It is really annoying.

Come on Avast! You were good in my eyes until now. Come back to us!

Good thing Steam has a Auto-Updater which replaces those files, and the those files are not incredibly big.

system · 2008-01-16T02:45:34.000Z

Played this game 3 days ago… NO Problem! Tried to play this game today… Virus message.

HELP!

system · 2008-01-16T02:57:46.000Z

I need a way to have avast ignore those two files (well with there instances in Day of Defeat, TFC, and Half-Life as well). Anyone want to show me how?

system · 2008-01-16T03:19:13.000Z

you can get them to ignore the files double clicking on your avast globe icon at the bottom of your screen next to your clock or open your avast program and go to standard shield then click customize and then advanced. Then click add and type in the path to the file C:\steam\steamapps\youremail@hotmail.com\counter-strike\hl.exe then click ok. I’ve been doing a scan and it is just going off about other files located in my steam folder as being viruses, like i said earlier i think this is just some kinda of screw up on avasts part because any problem associated with this begins today. I’m just gunna block mine and continue hopefully its nothing. I figure its either two things Avast is the only anti-virus program and internet source that knows about this Win32:steam-as trojan and steam is spreading viruses without knowing it (because i deleted the files and steam automatically replaces them when you try to play and avast still considers the newly replaced files a threat) or this is just a mistake from avast or as they call it a false positive. This is bummer but whatever ill just reformat if my system takes a dump. Hopefully avast doesn’t keep telling me about my files because as I scan they just keep coming up each hl.exe for every game that uses it and different .gcf files as well. Good luck to everyone else, and I’m sure its nothing.

system · 2008-01-16T03:27:28.000Z

Okay I’ll try that again. I thought it hadn’t worked but if it does I’ll do it.

system · 2008-01-16T04:40:31.000Z

Hey.

I’m using Avast home edition 4.7. Virus database version 080115-0, and earlier this afternoon it said alot of my steam files (like hl.exe)were infected by this Win32:Steam-AS trojan. I already deleted my steam folder and am using my laptop until Im sure theres no problem, but Ive seen alot of people (on the steam forums, for example) say its a false positive. Is it something i should worry about? ???

system · 2008-01-16T04:59:57.000Z

it is a false positive. Pause the Standard Scanner when trying to start the games that run with hl.exe and you’ll be fine. Just remember to start it again when your done playing or you’ll be out in the open.

Maxx_original · 2008-01-16T08:15:40.000Z

fixed… update your VPS

system · 2008-01-16T08:35:31.000Z

oh, then its really not a virus? phew 8)

system · 2008-01-16T08:39:43.000Z

ty vm glad it was fixed fast.

system · 2008-01-16T11:13:48.000Z

THX M8.
this is why i LOOOVVVVEEE Avast.

Thumbs up

Announcements