False positive in Slysoft sofware

Avast detected the virus Kelvir-z (add today new update) in c:/programs files\slysoft\anydvd\rgdrvls.exe

and c:/programs files\slysoft\clonecd\rgdrvls.exe

I dont think that they are virus. These are legitme not freeware software. I sent the files to avast. I check it in jotti page and only avast and Antivir detect it. Antvir detected it as bafis or bafir.

Please, don’t take so long to solve this… :‘( :’(

Calcu, maybe you can add this file to the two exclusions lists of avast (Standard Shield and on-demmand scanning).

Yes I wish Avast would pleast fix this. The RgDrvls.exe file is legal and is used by Slysoft under both CloneCD and AnyDVD.

Make sure you also send the file to Anti Vir so that they may fix the problem if it is a false positive.

Resolved in latest update

I’m very happy and proud of the speed of VPS update… 8) :wink:

I have run tests on this file (RgDrvls.exe, from SlySoft) with online scanners , and it indeed is being reported as suspicious and not to be trusted “maybe”, this file is a newfile and is not in the previous versions of AnyDvd from SlySoft, so maybe is is Malware ? has anyone heard anything else

another false positive?

I download anydvd directly from slysoft today:

02.10.2005 19:13:19 SYSTEM 524 Sign of “Win32:Ircbot-BG [Trj]” has been found in “C:\Program Files\SlySoft\AnyDVD\RgDrvls.exe” file.

Latest Avast Home Edition+VPS installed.

Hmm something wrong with the lastest VPS?

Getting the same false positive, but in G6FTPServer.exe which is a part of Gene 6 FTP server.
http://forum.avast.com/index.php?topic=16724.0

You could also check the offending/suspect file at: Jotti - Multi engine on-line virus scanner if any other scanners here detect them it is less likely to be a false positive. You can’t do this with the file in the chest, you will need to move it out.

If you are getting a virus warning that you believe is a false positive, then if you can zip and password protect (‘virus’, will do) the suspect file and send it to virus @ avast.com (no spaces).

Give a brief outline of the problem, the fact that you believe it to be a false positive and include the password in the body of the email. Some info on the avast version and VPS number (see about avast {right click avast icon}) will also help.

If it is indeed a false positive, add it to the exclusions lists and check scan it periodically using the ashQuick scan (right click scan), when it is no longer detected then remove it from the exclusions.

I get the exact same virus warning as zivilist with the exact same file (RgDrvls.exe) using the latest home version / updates but it finds it in CloneDVD2. Gotta be a false positive I guess but hope its fixed in the next VPS update. :stuck_out_tongue:

If you do as I suggested it will confirm it one way or another.

Can you resize your avatar as the forums try to keep to 100X100, thanks.

Update AVS, should be fixed in latest version 0539-6

Yes, it was fixed in the latest VPS update

Yep, all sorted. No longer shown as a virus. Nice one Avast! ;D