False Positive : Infection:Win32:Evo-gen [Susp]

Viruses and worms
1

Suddenly our clients can no longer download our client or patch from our game website.

This file was recently updated to include a new patch and worked fine for a week or two. It is now flagged by Avast and will not allow the users to download the file or even interact with Avast to indicate it is a legitimate file. The users are directed to a website and told to buy additional antivirus software. I checked the old version of the software (which thousands of our players have used without any virus alerts) and it is now flaggegd as a virus also.

Link 1: http://www.uorenaissance.com/downloads/UO_Renaissance_Client.exe
Link 2: http://www.uorenaissance.com/downloads/UO_Renaissance_Patch.exe

From our downloads section : http://www.uorenaissance.com/?page=m_download

Both links were prepared with Tarma Installmate v7. I have reported this problem to them also.
http://www.tarma.com/

Please let us know if there is a solution to this or if we need to advise our users to uninstalled Avast.

Thanks

Note: Telling our users that our site is infected with a message like this, when our site has no history of infections or hosting infected files is a bit over the top and can easily damage a legitimate sites reputation.

"avast! saved your computer from crashing

You just dodged a bullet

You may be wondering how you ended up with a virus, especially if you were visiting a ‘normal’ site. The latest research from the avast! Virus Lab shows that more than 80% of malware (viruses, spyware, and the like) spreads through legitimate websites, with only 1% coming from suspicious or ‘dodgy’ sites."

2
It is now flagged by Avast.......
flagged as what?....a screenshot would help

you may report it here. http://www.avast.com/contact-form.php
add a link to this topic in case they reply here…

3

It was in the title " Infection:Win32:Evo-gen [Susp]"

And when I try to file a report with avast attaching either of these files the connection is closed when trying to upload the attached file to avast.

The exe’s in question install and are scanned just fine if you can get them downloaded. Avast is simply refusing to allow them to be downloaded. Once downloaded (by disabling avast) they can be installed without any problems.

This is the alert the users are presented with. Note the complete lack of ability to report this as a legitimate file.

http://farm9.staticflickr.com/8249/8619708609_acf5c85fd0_o.png

This is the link they are sent to when clicking more details.

http://program.avast.com/api/?action=2&p_aas=0&p_adp=0000&p_age=50&p_cid=1&p_cpv=117441986&p_elm=7&p_fsh=11.5&p_idw=0&p_iid=0&p_inf=4&p_lan=1033&p_lci=1033&p_let=24&p_lex=81&p_lic=0&p_lid=en-us&p_lng=en&p_lqa=0&p_lqe=0&p_lst=0&p_lsu=24&p_man=0&p_osv=6.1&p_pro=0&p_rcv=1&p_reh=1200&p_rew=1920&p_vbd=1474&p_vep=7&p_ves=0&p_wnf=3&p_vir=Win32:Evo-gen%2520[Susp]&p_prc=C:\Users\crockwell\AppData\Local\Google\Chrome\Application\chrome.exe&p_obj=http://www.uorenaissance.com/downloads/UO_Renaissance_Client.exe

4
And when I try to file a report with avast attaching either of these files the connection is closed when trying to upload the attached file to avast.
if you move the file to avast chest manually.....then you can right click it in chest and upload it to avast lab it will then be uploaded at next auto/manuall avast update