False positive in Melodyne?

Viruses and worms
1

Hi, was gonna submit a ticket for this but I couldn’t register at the Support Centre so I am gonna post it here.

http://www.celemony.com/userforum/viewtopic.php?f=9&p=13817

Its a thread from Melodyne official forum. I got this trojan alert today while installing Melodyne after a clean Windows install. The Melodyne setup file was freshly downloaded from the Celemony website as well (since it was an update).

Thanks,
Frankie

2

You could also check the offending/suspect file at: VirusTotal - Multi engine on-line virus scanner and report the findings here. You can’t do this with the file securely in the chest, you need to extract it to a temporary (not original) location first, see below.

Create a folder called Suspect in the C:\ drive, e.g. C:\Suspect. Now exclude that folder in the Standard Shield, Customize, Advanced, Add, type (or copy and paste) C:\Suspect* That will stop the standard shield scanning any file you put in that folder. You should now be able to export any file in the chest to this folder and upload it to VirusTotal without avast alerting.

If it is indeed a false positive, see http://forum.avast.com/index.php?topic=34950.msg293451#msg293451, how to report it to avast! and what to do to exclude them until the problem is corrected.

3

Hi David

Here is the VT report : http://www.virustotal.com/analisis/dc42814fc12fe3144e513d9658e92e02

Surprising Avast didn’t think it is a trojan in this report… but my copy’s virus database is 25-Sep, whereas VT’s is only 22-Sep.

Just sent an email to virus@avast.com too.

Thanks a lot!
Frankie

4

Shame on VirusTotal… it’s an unacceptable delay…

5

You’re welcome.

It isn’t unusual to not have avast detect on VirusTotal when it does so on your system. VT isn’t able to update the VPS in real time as the user is and this is often the cause. Remember the point of submitting it to VT is to see what the other scanners find.

@ Frankie Ho (& Tech)
Lets not lose sight of the reason we are sending you to virustotal is to see what the ‘other’ scanners say. So to my thinking it isn’t as important what avast says on that scan as what the other scanners say. It also confirms that the detection by avast was as a result of recent VPS updates, so it still serves a purpose if it isn’t right up to date.

In this case the other two scanners that detect it as also detecting using generic signatures that are more prone to false detection. So you were right to submit it to avast for further analysis.

6

I think in all users, mostly in the ones that do not use avast… bad press…