False positive Win32:Evo-gen [Susp] ?

Viruses and worms
1

I am using Free Pascal 2.6.2 with IDE Lazarus 1.012 to develop a turnbased gameplaying program, which only uses console input/output via writeln() and readln(). It worked ok, but since a few days I cannot run it anymore because Avast puts it in Quarantaine, stating it contains Win32:Evo-gen [Susp] virus. Even versions of the .exe I used 2 weeks ago are not accepted anymore. How is this possible?!? When I scan in quarantaine nothing is found, but when I restore it it is refused again…
What can I do??? Also trying to compile a new version is immediately put in quarantaine…
Regards, Paul.

2

Please pause avast protection by right click on tray icon, shields control and disable permanently.

Then choose the file in quarantine and right click and then extract from chest and choose your desktop.

Upload the file at virustotal.com and post link here, please choose reanalyse when the file was already scanned.

3

Here are the results of the jury, everything looks ok, what now?
https://www.virustotal.com/nl/file/9a3f9148a0dbfdef0215c3adbced7db0efb4e490f1fd5525082c912f3945718a/analysis/1382999889/

4

OK. False positive.

You can send the file via mail to virus@avast.com Subject: false positive

Or choose the file in chest right click and submit to virus lab, choose false positive there and fill the form. It will be submitted in next update.

5
stating it contains Win32:Evo-gen [Susp] virus.
Win32:Evo-gen [[b]Susp[/b]] = Suspicious / not a virus

it is also new at VT. First submission 2013-10-28 22:38:09 UTC ( 12 minutes ago )

as suggested, send file to avast lab so they can check it

6

Steven, thanx for the help so far. I now used both ways to report the false positive to Avast. Hope they take some action soon, because now my developing / testing is effectively blocked :frowning:

7

Normally they react within 24 hours.

Sometimes it takes a bit longer.

8

Ok, I got a mail that it will be fixed in next VPS. But they didn’t say when that will be?

9

Normally there are 2 to 3 updates a day.

http://www.avast.com/de-de/virus-update-history

10

Yep, I got a mail to confirm that, and now it’s working ok! :slight_smile:
Thanx again for your help too.
Regards, Paul.

11

  1. My system:
    1.1. Windows 7, 32 bit.
    1.2. AVAST 2014 (9.0.2006), current definitions (131029-1).
    1.3. All Windows updates in place.

  2. My friend’s system:
    1.1. Windows 7, 64 bit.
    1.2. AVAST 2014 (9.0.2006), current definitions (131029-1).
    1.3. All Windows updates in place.

  3. I wrote a program, and it was scanned on my system:
    3.1. AVAST 2014 (9.0.2006), current updates, no problems.
    3.2. SPYBOT 2.1.21-SR2, current updates, no problems.
    3.3. EMSISOFT ANTI-MALWARE, current updates, no problems.
    3.4. SUPERANTISPYWARE, current updates, no problems.
    3.5. BIT DEFENDER FREE, current updates, no problems (on a virtual machine).
    3.6. MALWAREBYTES, current updates, no problems (on a virtual machine).
    3.7. COMODO ANTIVIRUS, current updates, no problems (on a virtual machine).
    3.8. AD-AWARE FREE ANTIVIRUS+, current updates, no problems (on a virtual machine).
    3.9. Uploaded it to several on-line scanning sites, no problems.

  4. The same program was downloaded from my site, to my system, no problems.

  5. My friend tried to download from my site, to his system, AVAST pitched a fit said the file had (Win32:Evo-Gen[Susp]).

12

Yes, strange. The best you can do is follow Steven’s advice:
Send the file via mail to virus@avast.com Subject: false positive
And choose the file in chest right click and submit to virus lab, choose false positive there and fill the form. It will be submitted in next update.

13

And now the same false positive error occurs when I try Free pascal 64-bit…:frowning:
I gave notice to Avast, hope they will fix it soon!

14

You can also add it to the global exclusions for now…