False positive on compiled report file

Viruses and worms
1

Hi!
today avast detected one compiled report file as Win32.evo-Gen

http://img27.imageshack.us/img27/7532/19569040.jpg

Very strange, in virustotal list doesn’t appear as detected:
https://www.virustotal.com/en/file/30ce9d5c78a9e6fd16d6c2d2ba91ee084432837446aa4d3548707dc248640898/analysis/1366434116/
also file sent by AV interface.
Thanks

2

It’s good that you sent that file via Avast file submission. It will take them a while or so to review the file you submitted and update it’s vps.

3

seems solved,thanks!

4

Hi,after update from today,problem is back for another compiled report file:

http://img707.imageshack.us/img707/8946/20130604081630.png

https://www.virustotal.com/en/file/b96971db5ae22aa64033fc0a470bacaa714f9c4b23f2caf69af426952f319a20/analysis/1370322858/

I also sent file from Avast interface
Thanks!

5

please fix that!

6

The first report looks to be 7-zip. Basically compresses files to a smaller size. The Second not sure. It’s probably not so nice. I’d say you possibly have a virus that infecting all .exe files. If that’s the case you might want to scan with MBAM (MalwareBytes Anti-Malware).

7
I'd say you possibly have a virus that infecting all .exe files.
malwarebytes does not detect infected files from fileinfectors.....it will only detect the executable

if there is a fileinfector, avast usually goes bananas and should give lots of alarms…

8

Didn’t know that. Ignore me.

9

Screenshots are made while I unpack the file because I put it into a zip file not to be detected/deleted
What is strange with this file is that if I scan it there is nothing found,but if I try to copy/move it,then is detected.

Rechecked with virustotal,nothing found : https://www.virustotal.com/en/file/b96971db5ae22aa64033fc0a470bacaa714f9c4b23f2caf69af426952f319a20/analysis/1370584897/

I put also file there : hXXp://www.mediafire.com/download/5j2chzxxb4vten4/EXTRAS.zip

(change link from hXXp… to http… )

10

please
you can use “http://www.avast.com/contact-form.php” for reporting FPs.

11

Evo-gen is only real time detection technology…not on-demand

12

detection is correct
[/quote]

confirmed
that’s true.

13

So if detection is correct why today that was fixed?

14

From today problem is back,please fix tat is the THIRD TIME !!! :frowning:
this time on another compiled report : please see this file http://www.mediafire.com/download/6uft9x7tm2asu35/CASHFLOW.zip

on Virustotal nothing reported :https://www.virustotal.com/en/file/0067313ba027e34ac2cde35a341c12cf2d990b6e44a3cf438c1bfecf793cde79/analysis/1372339451/

15

again,seems solved
maybe there is something wrong with detection shield :frowning:

16

I don’t know.
maybe I got the wrong answer
in my view is a false positive.
If the samples was sent through the contact form it will be fixed.

17

Yes It was sent couple days ago
thanks!

18

same problem is back,
so,this is the file : http://www.mediafire.com/download/u8zx21y12wcr508/report1.zip
scan it,nothing is found

http://imageshack.us/a/img163/8568/f4gi.png

try to copy/paste it to another location : NOW IS DETECTED :

http://imageshack.us/a/img689/4012/4dyf.png

ALSO SUBMITTED FROM AV INTERFACE

there is a virus total link :
https://www.virustotal.com/en/file/691bd502c27c5411d0d1e9c647341f437c8409e17628b56203f9a2de44ead752/analysis/1374583090/

19

With the amount of (POSSIBLE) FP’s you have. I’d say you are probably infected with something Avast cannot detect as of yet. That’s too many.

20

Read one of my possible false positive:

http://forum.avast.com/index.php?topic=128209.msg957260#msg957260

There is the aswer :
[b]Hello,
thanks for notice, it will be fixed in next stream update.

Milos[/b]

also Virus Total link: Detection ratio: 0 / 47