Many False Positive

Viruses and worms
1

In last month-two I have problem with false positive files. Many files. At most they are installers for different programs, and it seems that all of installers are created with Inno Setup and NSIS.

OK, I can exclude that files from scanning, but whay that happens? What is problem with this instellers?

2

Please pack the misdetected files into a password-protected ZIP or RAR and send them (together with the password) to virus@avast.com for analysis.
Or, if they are big, it’s possible to upload them to ftp://ftp.avast.com/incoming - but in that case please send a notice here, because the FTP is not monitored.

3

Exclusion is just masking a problem, correcting the problem is the best solution.

I may be just what a file is doing that may be consider suspect, but since you don’t give any information (file name, location and malware name) it is impossible to say (or correct).

If you get what you believe to be a false positive you need to confirm or deny the detection one way or an other and if confirmed as an FP then the sample should be sent to avast, so that they can analyse the file and correct the VPS so it isn’t detected.

Actions:
You could also check the offending/suspect file at: VirusTotal - Multi engine on-line virus scanner and report the findings here. You can’t do this with the file securely in the chest, you need to extract it to a temporary (not original) location first, see below.

Create a folder called Suspect in the C:\ drive, e.g. C:\Suspect. Now exclude that folder in the Standard Shield, Customize, Advanced, Add, type (or copy and paste) C:\Suspect* That will stop the standard shield scanning any file you put in that folder. You should now be able to export any file in the chest to this folder and upload it to VirusTotal without avast alerting.

If it is indeed a false positive, see http://forum.avast.com/index.php?topic=34950.msg293451#msg293451, how to report it to avast! and what to do to exclude them until the problem is corrected.

4

Ok, when I get better Internet connection, I will upload all files. That will be in next few days. Also, I will upload some files, unknown status for now, but for one I’m sure that is backdoor because it start Firefox in background. All of that files Avast don’t recognize as potentialy dangerous.

Best Regards,
Igor

5

Thanks for helping improving detection.

6

Why I can’t upload files on Your ftp server? Some 553 error is present!

7

What filename are you trying to upload?

8 

9x2klbr.rar
avm.exe
Deluxe Tree 2.4.exe
jKeys.exe
lancer.exe
Mp4 Player 4.0.exe
SetupTool.exe
SignMan.exe
Tweaker 2.7.7.exe
VAG EEPROM Programmer 1.3.exe
Vista Drive Icon 1.2.exe
9

Why are you uploading that files? All of them are being false detected? ???

10

Some are detected as shits, but some like: lancer.exe and SetupTool.exe aren’t detected, but I’m 100% sure that are some shits.

P.S. I’ve rar all these files into one rar archive called posibile_shits.rar with password: pwd123456. Now, I’ll try upload it again…

11

That’s exactly why using FTP is not a good idea… somebody uploads a group of files and nobody knows what they are. Putting suspected false positives and false negatives into one archive doesn’t really help either.

So, can you please tell us which of them you consider false positives at least?

12

I think that:

avm.exe
Deluxe Tree 2.4.exe
jKeys.exe
Mp4 Player 4.0.exe
SignMan.exe
Tweaker 2.7.7.exe
VAG EEPROM Programmer 1.3.exe
Vista Drive Icon 1.2.exe

are false positives. For files inside 9x2klbr.rar i’m not sure.

Lancer.exe and SetupTool.exe Avira detect as some shit but avast doesn’t.

I found by myself that SetupTool.exe is trojan because in start Firefox in background.