I have an old copy of a screenmate, Felix, which came out in 2001. It has passed virus scans probably more than a 100 times until this month, when Avast detected it as Win32.Neptunia-AQ. I thought maybe my copy had been corrupted somehow, but every copy I’ve tried to download at various sites gets stopped by Avast and it reports the file is infected with the same trojan. I’ve been googling and I found nothing about it containing a trojan elsewhere (I did find a newer version which passed the virus scan, but as it requires registration I want to keep the older version). It just seems unlikely that such an old file has been carrying a trojan that wasn’t detected until the 9th of this month.
Some info about the file; File name: Variously felix.exe, full_fel.exe, cat.exe. Size: 300 kb. This program is not installed, you run it with the .exe (what they consider portable software nowadays).
Now, I know it must seem silly, but I’m pretty attached to this little program, as I’ve had it so long. If it is a false positive, how do I get Avast to ignore it? It won’t let me run or download it unless I stop on-access protection, which I don’t like to do.
To know if a file is a false positive, please submit it to JOTTI or VirusTotal and let us know the result. If it is indeed a false positive, send it in a password protected zip to virus@avast.com
Please, mention in the body of the message why you think it is a false positive and the password used. Thanks.
VirusTotal and Jotti both have file size limits 10 and 15MB each.
As a workaround, you can add these files to the Standard Shield provider (on-access scanning) exclusion list.
Left click the ‘a’ blue icon, click on the provider icon at left and then Customize. Go to Advanced tab and click on Add button…
You can use wildcards like * and ?. But be carefull, you should ‘exclude’ that many files that let your system in danger.
After that, please, periodically check it - scan it into Chest, right clicking the file - there should still be a copy in the chest even though you restored it to the original location. When it is no longer detected as being infected then you can also remove it from the Exclusion list.
I’m seeing the same thing. Both JOTTI and VirusTotal have a few tests return as Joke/Screenmate which is exactly what it is; not a Trojan. Well, I think it is safe but I sent a copy in just to be sure.
FYI, for the file I sent in, the MD5=0e4baee67e1dce71c1a334e22e50380e and the current VPS on this machine is 000775-4, 09/20/2007.