I have just tried to download the latest DivX installer (DivXInstaller.exe), and avast! pops up and tells me that it is virus.
This has happened to me on a number of occasions with legitimate files.
So how do I get avast! to ignore this when it happens? I had to download the file again with On-Access Protection turned off. :-\
You can just pause your Web Shield Provider and Standard Shield provider then continue your download but you are taking risk so after finish download, resume the two providers.
Needs checking. Can somebody from avast! download the file from the DivX site, 'cos it’s too big to email?
Antivirus Version Last Update Result
AhnLab-V3 2008.5.30.1 2008.06.05 -
AntiVir 7.8.0.26 2008.06.06 -
Authentium 5.1.0.4 2008.06.05 -
Avast 4.8.1195.0 2008.06.06 Win32:Adware-gen
AVG 7.5.0.516 2008.06.05 -
BitDefender 7.2 2008.06.06 -
CAT-QuickHeal 9.50 2008.06.05 -
ClamAV 0.92.1 2008.06.06 Trojan.VB-2953
DrWeb 4.44.0.09170 2008.06.05 Adware.Yassist.origin
eSafe 7.0.15.0 2008.06.05 -
eTrust-Vet 31.6.5850 2008.06.05 -
Ewido 4.0 2008.06.05 -
F-Prot 4.4.4.56 2008.06.05 -
F-Secure 6.70.13260.0 2008.06.06 -
Fortinet 3.14.0.0 2008.06.06 -
GData 2.0.7306.1023 2008.06.06 -
Ikarus T3.1.1.26.0 2008.06.06 -
Kaspersky 7.0.0.125 2008.06.06 -
McAfee 5311 2008.06.05 -
Microsoft 1.3604 2008.06.06 -
NOD32v2 3162 2008.06.05 -
Norman 5.80.02 2008.06.05 -
Panda 9.0.0.4 2008.06.05 -
Prevx1 V2 2008.06.06 Malicious Software
Rising 20.47.40.00 2008.06.06 -
Sophos 4.30.0 2008.06.06 -
Sunbelt 3.0.1145.1 2008.06.05 -
Symantec 10 2008.06.06 -
TheHacker 6.2.92.337 2008.06.06 -
VBA32 3.12.6.7 2008.06.05 -
VirusBuster 4.3.26:9 2008.06.05 -
Webwasher-Gateway 6.6.2 2008.06.06 -
So four AV detect it. Is that a false positive?
Needs checking. It’s not unheard of for several AV’s to be wrong, and DivX has never been associated with malware before, but the Doctor Web detection is pretty specific. The avast! team will need to look into it because the avast! detection is only generic and could be wrong.
I would still like to see a better way to allow a file through to finish downloading if a user wants to.
Other AVs that I have used in the past allowed it.
Not all browsers have the avast Webshield which is the scanner that, I suspect, is finding the problem with this download. Perhaps you can advise us of the av products that you have used previously that do allow you to override an http scanner. Even so, I suspect that the majority of us are willing to live with this “problem” of an occasional false positive rather than download an infected file.
I understand that a false positive is irritating but you not need to turn off all on access protection. For myself I find that ignoring the alarm from the Webshield allows the download to complete (after a time) without any further problems (unless like me you have a an automatic scan of downloaded fiiles which again reported the file as infected and requires me to tell avast to ignore the suspected infection).
You also have the option to pause the Webshield and download again, you have the option to tell the Webshield not to scan the URL from which you are making this download.
If this has happened on a “number of occasions with legitimate files” (though a scan fails to find any reported in the couple of months you have been registered) then I regret that you must be more unfortunate than most of us.
I was using Firefox.
In regards to other AVs that give you the option to ignore. I thought someone may ask that.
I have used many AVs over the years, and I cannot recall ever having trouble continuing a download from the alert screen.
I will resist posting AVs that allow this. As far as I can remember, none of the others didn’t offer an option to ignore.
Hmmm … over the years many will not have had an http scanner (in fact most have not).
I used Firefox too to download this same file as you … just ignored the alert to “abort the connection” and it completed. The avast scan of the downloaded file did did offer the option to “continue”.
So please tell me how to ignore. I still don’t see any ignore option. If I close the dialog, the download fails to complete.
Rassel said in reply #1.
Take care… file does not seem a false positive…
I think ‘Yassist’ that DrWeb found has something to do with the Yahoo toolbar that comes with the DivX Player.
I ran into the same problem with Divxinstaller. After pausing webshield, I downloaded the file from majorgeeks and scanned it manually. Avast detected Win32:Adware-gen in y_toolbar.exe, so it seems like the yahoo toolbar installer is causing the false positives.
For many of us Yahoo Toolbar is NOT a false positive
read their EULA
they also do a poor job policing their “affiliates”