False positives

Viruses and worms
1

I have recently switched from Avast to Avg due to performance reasons and the behavior shield that Avg uses seems to detect more false positives than Avast ever did. In the last few weeks, a legitimate process in windows (can’t remember which one it was) and TeamViewer’s sponsor window “7.hta” have both been blocked, an occurrence that had never happened while I was using Avast. :-\

EDIT: The windows process in question was “mshta.exe”.

2

Hello,
post a screenshot of the window with detection, please.

Milos

3

This is for the Teamviewer app. I couldn’t reproduce the windows process one because it happened on a laptop I was servicing, you’ll just have to trust me on that one.

4

Here’s another false positive detected by the behavior shield. This is a legitimate AutoCad installation file downloaded from their website.

VirusTotal analysis: https://www.virustotal.com/#/file/b9c299c25f8d4658ff433062c770400b20fc9bcf6c8c6abc1d587d5d90fc3c07/detection

5

In response to your lats post (and picture) - if I’m thinking of the right think, IDP detection’s have a guideline to follow for detection that is almost universal. Though I can’t find the information on it.

Milos (or someone qualified from Avast!) will swing by again and check things out.

6

https://i.imgur.com/DWaaKoJ.jpg

Here is a screenshot of the issue. Its happening to me as well now after I update teamviewer.

7

You can report a suspected FP (File/Website) here: https://www.avast.com/false-positive-file-form.php

8

Even after reporting the file, and getting a response from Avast that it has been whitelisted, the 7.hta file is still getting flagged.

9

Strange, wait for Milos…

10

Hello!

Any news regarding this problem?

11

Hi,

the problem of the 7.hta is that it’s generated after each start or the TeamViever Free. You should add the exception for the full path for Behavioral Shield.

Regards,
PDI

12

Yes, I was contacted by Avast recently. They said they’d have to look into it with TeamViewer’s representatives as the software itself is generating “very suspicious files with adverts with no digital signature”.