Is that False Positive: Win32: Spyware-gen [Trj] in Alcohol 120% exe Prog. file

Viruses and worms
1

I am the user of Avast 4 Home Edition antivirus software and my Avast version is 4.8.1335. For the safety reason, I am usually perform the standard virus scan for all my local non-removable disks with archive files during the scan, the Program files of Alcohol Soft Alcohol 120% exe program file was infected by virus Win 32:Spyware-gen [Trj] and I skip it (i.e. do not take any action at time of scanning ) and continue the scanning process, after the scanning process finished and the result is 1 file was infected. The result of last scan showed that “C:\Program Files\Alcohol Soft\Alcohol 120\Alcohol. exe” file was infected by Win 32: Spyware-gen [Trj], so I highlight the line and right click the action of “Repair” button and choose to repair all function, and it showed that the file was successfully repaired. However, after that, I re-scan the infected program and the virus of Win 32: Spyware-gen [Trj] still be existed.

In fact , I perform standard virus scan daily and no files was infected yesterday (13 July 09) and today after my virus database version is updated to 090713-0, I perform the standard virus scan for all my local non-removable disks with archive files as usual and the result is 1 file was infected as mentioned above.

In my Log viewer, there also had the warning section, and the description is Sign of "Win32: Spyware-gen [Trj] " has been found in

“C:\Program Files\Alcohol Soft\Alcohol 120\Alcohol.exe” file

So what can I do now and I’m really do not have any idea why that the Alcohol exe file was infected. Can anyone helps me to solve this problem.

Thanks for kindly attention…
From Hihikaren

2

I hate to say this but according to VirusTotal, other scanners say it’s a password stealer.

3

Maybe it is a false positive. Try to send it to virus (at) avast (dot) com

4

Hi hihikaren,

To get an idea of this, please, upload the file to virustotal.com and present us with the results,

polonus

5

Hi polonus~~

Thanks for your help, I’ve just upload the infected file to virustotal.com and the result is as follows:

File alcohol.exe received on 2009.07.14 20:39:15 (UTC)
Current status: finished

Result: 12/41 (29.27%)
Compact Print results

Antivirus Version Last Update Result
a-squared 4.5.0.22 2009.07.14 Trojan-Downloader.Win32.Banload!IK
AhnLab-V3 5.0.0.2 2009.07.14 -
AntiVir 7.9.0.215 2009.07.14 TR/Spy.189440.A
Antiy-AVL 2.0.3.1 2009.07.14 Trojan/Win32.VB.gen
Authentium 5.1.2.4 2009.07.14 -
Avast 4.8.1335.0 2009.07.14 Win32:Spyware-gen
AVG 8.5.0.387 2009.07.14 PSW.Ldpinch.WVN
BitDefender 7.2 2009.07.14 -
CAT-QuickHeal 10.00 2009.07.14 Trojan.Agent.IRC
ClamAV 0.94.1 2009.07.14 -
Comodo 1651 2009.07.14 -
DrWeb 5.0.0.12182 2009.07.14 -
eSafe 7.0.17.0 2009.07.14 Suspicious File
eTrust-Vet 31.6.6612 2009.07.14 -
F-Prot 4.4.4.56 2009.07.14 -
F-Secure 8.0.14470.0 2009.07.14 -
Fortinet 3.120.0.0 2009.07.14 -
GData 19 2009.07.14 Win32:Spyware-gen
Ikarus T3.1.1.64.0 2009.07.14 Trojan-Downloader.Win32.Banload
Jiangmin 11.0.706 2009.07.14 -
K7AntiVirus 7.10.792 2009.07.14 -
Kaspersky 7.0.0.125 2009.07.14 -
McAfee 5676 2009.07.14 -
McAfee+Artemis 5676 2009.07.14 -
McAfee-GW-Edition 6.8.5 2009.07.14 Heuristic.LooksLike.Trojan.Crypt.ZPACK.C
Microsoft 1.4803 2009.07.14 -
NOD32 4243 2009.07.14 -
Norman 6.01.09 2009.07.14 -
nProtect 2009.1.8.0 2009.07.14 -
Panda 10.0.0.14 2009.07.14 -
PCTools 4.4.2.0 2009.07.14 -
Prevx 3.0 2009.07.14 -
Rising 21.38.14.00 2009.07.14 -
Sophos 4.43.0 2009.07.14 Mal/Generic-A
Sunbelt 3.2.1858.2 2009.07.14 -
Symantec 1.4.4.12 2009.07.14 -
TheHacker 6.3.4.3.366 2009.07.14 -
TrendMicro 8.950.0.1094 2009.07.14 -
VBA32 3.12.10.8 2009.07.14 -
ViRobot 2009.7.14.1835 2009.07.14 Trojan.Win32.PSWLdPinch.159744.B
VirusBuster 4.6.5.0 2009.07.14 -

Do I need to uninstall the existing Alcohol 120% Program and find the new version of Alcohol 120% to reinstall it again??
Thanks for kindly attention again~~
Hihikaren

6

Thanks for reporting false positive, it will be fixed in next VPS update.