False positive keyhook.dll in ScreenshotCaptor.exe

Viruses and worms
1

Avast pre-boot scan reported a trojan,

Win32:Delf-SG [Trj], in

keyhook.dll,
within a ZIP file, ScreenshotCaptor.exe.

My Avast virus database was updated yesterday, then again today.

I contacted the site which offers the file, http://www.donationcoder.com, and was told this is an ongoing false positive problem.

Avast is a great program, giving home users awesome protection at no cost! I’ve used it for a few years and trust the protection it offers.
False alarms detract from Avast’s veracity, as well as scaring people off from safe programs.

What can be done to:

  • prevent false alarms?
  • when discovered, remove false positives quickly from the virus database?

Thanks.

2

If you are getting a virus warning that you believe is a false positive, then if you can zip and password protect (‘virus’, will do) the suspect file and send it to virus @ avast.com (no spaces), or send from the chest.

Give a brief outline of the problem (possibly a link to this thread), the fact that you believe it to be a false positive and include the password in the body of the email. Some info on the avast version and VPS number (see about avast {right click avast icon}) will also help.

You could also check the offending/suspect file at: Jotti - Multi engine on-line virus scanner if any other scanners here detect them it is less likely to be a false positive. You can’t do this with the file in the chest, you will need to move it out.
Or VirusTotal - Multi engine on-line virus scanner

If it is indeed a false positive, add it to the exclusions lists (Standard Shield, Customize, Advanced and Program Settings, Exclusions) and check scan it periodically using the ashQuick scan (right click scan), when it is no longer detected then remove it from the exclusions.
Also see (Mini Sticky) False Positives

3

Hi DavidR,

I scanned the file at http://virusscan.jotti.org/, and only Avast reported the trojan.

I also sent an email with the file zipped and passworded to virus @ avast. com, with details.

(Mini Sticky) False Positives is an excellent guide, so I’ve saved the procedures.

Thank you for your help.

  • D
4

Your welcome.

Just add it to the exclusions, etc. I mentioned above and that should be you done.