Sign of “Win32:Nsane” has been found in “http://www.spywareedge.net/nf/nailfix.exe” file.
False positive after last virus database (31.3.2006)? I used that program 2 months ago to remove Aurora / Nail as adviced in http://forums.maddoktor2.com/index.php?showtopic=5104.
Please don’t post live links to suspect files, break the link using spaces, etc. so we can see the location but the link isn’t live, e.g. http: www dot spywareedge.net/nf/nailfix.exe.
Since you used the program for virus removal there is possibly a signature of the virus it is hunting contained in the file and it would be that signature that avast is alerting on.
So I would say if that is the case it isn’t a false positive detection, rather avast not knowing for what purpose the file is to be put. Had the signature element in the file been encrypted it probably wouldn’t have been detected.
avast’s web shield also alerts on one of the other nailfix.exe locations, the other location isn’t working any longer. So I would say it is in all the nailfix.exe files and is likely to be an unencrypted virus signature that is causing it.
You would have to pause the web shield to get it to download (if you are happy about it and assume any risk). You could report it to avast.
If you are getting a virus warning that you believe is a false positive, then if you can zip and password protect (‘virus’, will do) the suspect file and send it to virus @ avast.com (no spaces), or send from the chest.
Give a brief outline of the problem (possibly a link to this thread), the fact that you believe it to be a either a false positive and include the password in the body of the email. Some info on the avast version and VPS number (see about avast {right click avast icon}) will also help.
You could also check the offending/suspect file at: Jotti - Multi engine on-line virus scanner if any other scanners here detect them it is less likely to be a false positive. You can’t do this with the file in the chest, you will need to move it out.
Or VirusTotal - Multi engine on-line virus scanner
If it is indeed a false positive, add it to the exclusions lists (Standard Shield, Customize, Advanced and Program Settings, Exclusions) and check scan it periodically using the ashQuick scan (right click scan), when it is no longer detected then remove it from the exclusions.
Also see (Mini Sticky) False Positives
Thank for your replay. I should have mentioned that I tested that file with Jotti. None of other programs complained of that file.
I only wanted you to know that there is false positive detektion, which started with 31.3.2006 signatures.
False positive :-\
That’s fine thanks, the best way to do that is to send a sample to avast as in the false positive info given.
Submitting it to Jotti if the file was undetected by avast but others detected it then a sample would eventually get sent to avast. However, I believe that isn’t the case when avast is the only one to detect it, nothing is sent to avast. So avast won’t know about the false positive detection, unless a sample is sent that they can analyse and edit the VPS signature file.