I have searched for FFPage.exe on google and found 0 results. I’m sure many other users must be encountering this and yet there is no information out there regarding this, so I am here to ask for help.
I use imesh to download music legally and when I try to download the program and install, I have to disable my anti-virus because it kills the attempt, stating that “A Virus Was Found!” and points to “FFPage.exe” stating that it is a “Win32:Trojan-gen {VC}”, Malware type: “Virus/Worm.” And then after I install the program, it continually tells me about this supposed trojan. I added it to my exclude list for now, but should I be concerned here? Also, to note, I am downloading Imesh from Imesh’s download links, not a third-party distributer, so the links should be safe. I’m not writing this off as a false-positive because I have imesh on my business laptop where I process very sensitive information for my clients and I am legally bound to keep their information safe and secure.
Not getting a hit on google in itself I would normally say is suspicious. So I would be concerned enough to do some further investigation.
Upload to VirusTotal - Multi engine on-line virus scanner and report the findings of these files here. If any are detected by multiple scanners then that pretty much confirms the avast detection.
Create a folder called Suspect in the C:\ drive, e.g. C:\Suspect. Now exclude that folder in the Standard Shield, Customize, Advanced, Add, type (or copy and paste) C:\Suspect* That will stop the standard shield scanning any file you put in that folder. You should now be able to export any file in the chest to this folder and upload it to VirusTotal without avast alerting.
If only avast detects it on virus total:
Send the sample to virus@avast.com zipped and password protected with the password in email body, a link to this topic might help and false positive in the subject.
Or you can also add the file to the User Files (File, Add) section of the avast chest (if not already there) where it can do no harm and send it from there (select the file, right click, email to Alwil Software). No need to zip and PW protect when the sample is sent from chest. A copy of the file/s will remain in the original location, so any further action you take can remove that.