False positive (setool2lt.exe)?

Viruses and worms
1

Hi!

I use an application called setool 2 lite (setool2lt.exe). This is an application used to flash, unlock and de-brand cellphones (legal in the US and most other countries).
Avast classifies this as “Win32:Trojan-gen {Other}”. As far as I can see, this is not malware or even a virus of any kind.
Why is it flagged as a trojan? Have used this application a long time without any issues.

The author runs this webpage: http://www.setool.net/support/SETool2/

Virustotal says this: http://www.virustotal.com/analisis/b66822e70fbc24e07b7ce52c21b26b840aef9be1b21d87638a1d146324b1858c-1249831435

So apparently avast is not the only one flagging this as malware. Avast has never flagged this previously, has avast become a copycat?

//Odin

2

Hi.This is likely a false positive as most of the antivirus detected it using some kind of heuristic.You can report to avast by:
Right click avast icon in taskbar -->click start avast antivirus -->right click scanner background → click virus chest → navigate to user files → click add files →
right click file -->email to alwil software.

The file will be sent to the lab for analysis next time the database is updated

3

the file is packed with Themida… Themida is a tough packer and is quite hard to analyze… there’s a possibility to make a wrong decision and detect the sample even with the best effort of the analyst… report the file as a false positive from the warning dialog :wink:

4

Did that, hopefully they will fix it…