Need help with a file thats reported as virus.

DavidR · 2007-05-03T21:27:19.000Z

It is most likely to be a false positive detection, see http://forum.avast.com/index.php?topic=28170.0, same issue.

If it is indeed a false positive, add it to the exclusions lists (Standard Shield, Customize, Advanced, Add and Program Settings, Exclusions) and periodically check it (scan it in the chest), there should still be a copy in the chest even though you restored it to the original location. When it is no longer detected then you can also remove it from the Standard Shield and Program Settings, exclusions.

Send the sample to virus@avast.com zipped and password protected with password in email body and false positive in the subject. Or you can also send it from the the avast chest if there is a copy there (select the file, right click, email to Alwil Software). No need to zip and PW protect when the sample is sent from chest.

system · 2007-05-03T21:33:56.000Z

Thanks for the fast reply.
I forgot to mention the file is located in my Temp folder i get a new copy of it as soon as i delete it or move or rename it. So i have had to disable live protection in avast or i cant do anything due to warnings popup constantly. I’ll check my chest if theres a copy of it and send it though.
Thanks again.

Sent from chest now.

Lisandro · 2007-05-03T22:38:42.000Z

lanjelin post:3:

I forgot to mention the file is located in my Temp folder i get a new copy of it as soon as i delete it or move or rename it.

If a virus is replicant (coming and coming again), better than to disable the antivirus protection, you should:

Disable System Restore on Windows ME or Windows XP. System Restore cannot be disabled on Windows 9x and it’s not available in Windows 2k. After boot you can enable System Restore again after step 3).
Clean your temporary files. You can use CleanUp or the Windows Advanced Care features for that.
Schedule a boot time scanning with avast. Start avast! > Right click the skin > Schedule a boot-time scanning. Select for scanning archives. Boot. Other option is scanning in SafeMode (repeatedly press F8 while booting).
It will be good if you download, install, update and run AVG Antispyware. Some users recommend SUPERantispyware, Spyware Terminator and/or a-squared (take care about false positives).
Use the immunization of SpywareBlaster or, which is better, the Windows Advanced Care features of spyware/adware cleaning and removal.

DavidR · 2007-05-03T22:45:27.000Z

Don’t disable the protection, exclude the file. In my post above you will see you can add the file location to the exclusions lists.

What is a surprise to me is that the file is in a Temp location (the same as the other topic) and not the ashampoo program folder. So it must be generated by ashampoo, a crazy situation using the temp folder for something to stealth ashampoo I believe.

You should also send a sample to avast for analysis.
Also see (Mini Sticky) False Positives, how to report it to avast! and what to do to exclude them until the problem is corrected.

DavidR · 2007-05-03T22:46:52.000Z

Tech post:4:

lanjelin post:3:

I forgot to mention the file is located in my Temp folder i get a new copy of it as soon as i delete it or move or rename it.

If a virus is replicant (coming and coming again), better than to disable the antivirus protection, you should:

It is an FP on an ashampoo stealthing file.

Lisandro · 2007-05-03T22:57:11.000Z

DavidR post:6:

It is an FP on an ashampoo stealthing file.

Sorry…

system · 2007-05-04T07:12:32.000Z

For now, the easiest solution is to chanage the ashampoo firewall.

DavidR · 2007-05-04T12:26:53.000Z

The easiest by far is to exclude the files being detected, far easier than choosing another firewall, downloading it uninstalling ashampoo, reboot and installing the new firewall.

Unless there is something that you are dissatisfied with about ashampoo then excluding the files will take about 1 minute.

system · 2007-05-04T12:49:43.000Z

Hello, I am also new to this forum and I’ve got to say that it is a very helpful forum, so for that I thank everyone that posts on here. As for avast I also got warnings that my PC had a unknown virus/worm that said ASFWhide. I gathered that it had something to do with my Ashampoo Firewall. I run Ashampoo Firewall on my home PC as well as my Laptop. Yesterday when I turned on my Home PC and avast did it usual update the problem arose. I was scared at first that my PC was infected, I phoned my friend who said that it was likely that Ashampoo had attached a new file that avast scanned as a possible virus/worm. I tried everything to get rid of it like others have but to no avail. I decided that my best option was to uninstall Ashampoo Firewall and install another one. I have now installed PC Tools free Firewall and everything is ok. The samething happened this morning when I booted up my Laptop, so needless to say I have uninstalled it on there as well and install PC Tools one.

Since I have uninstall the firewall I have not had a problem and done full scans on both PC’s and nothing has been detected.
Still, I will be watching to see if the Tech Guys at avast solve the issue as Ashampoo is a very good firewall.

DavidR · 2007-05-04T13:55:48.000Z

Then reinstall it and simply exclude the file (in my fires reply) that is being detected as it would appear to be a false positive detection and if no one submits a sample for analysis (as I mentioned in an earlier post) then the problem won’t be resolved quickly.

It really is easy to do, Program Settings, Exclusions, Browse, this allows to to navigate to the file to exclude. Once selected you will see the path transferred into the Selected paths: window, copy this path before clicking OK (you can paste this into the Standard Shield, Customize, Advanced, Add window part two).

system · 2007-05-04T14:48:03.000Z

Please see my first reply, I have sent the file trough the chest, I did that as soon as i got your suggestion that i do so. Just so theres no misunderstanding.
Very good forum, fast reply and understandable. ;D

DavidR · 2007-05-04T15:33:34.000Z

My reply was directed at Paul Earlyman a new poster in the topic (perhaps not too well worded in my haste), but it never hurts to have others submit a probable false positive detection. It may apply a little more prompting/pressure to correct the problem.

system · 2007-05-04T17:24:31.000Z

I know that maybe I should have report it to avast for there detection and testing but as I said before, I had already uninstalled it and tried PC Tools free Firewall. I have run various test on PC Tools firewall like the leak test and a couple of others from the same website, and it passed all of them. So I was just happy that the potential virus/worm had gone. Maybe this was not the right choice as others have suggested different solutions to the problem but at the same time I am now happy that my PC’s are protected.

system · 2007-05-04T17:52:58.000Z

Hello everyone,

But excluding this file dosen`t help much, because it is excluding "except for the resident protection", so avast still show the message of file ASFWHide. Maybe there is another options in Avast, but i have no seen it.
ASFHide is not a virus, but a part of Ashampoo which looks like virus for some antivirs.

system · 2007-05-04T17:56:11.000Z

And some more info about ASFWHide if you need

http://www.sophos.com/security/analyses/ashampoofirewall_FqgC.fDR.html

DavidR · 2007-05-04T18:08:44.000Z

@ Paul Earlyman
No problem, my reasoning in sending the file was that it also helps others who might have avast and ashampoo and not just those posting in the forums.

Personally I think you are probably better off with the PC Tools firewall, I recall some issues with ashampoo firewall in the forums before and the PC Tools firewall has received some praise from those forum members using it.

Welcome to the forums.

@ T34
There are two exceptions lists one for on-access (Standard Shield, Customize,Advanced, Add) the most important one as that is the one which is likely to be triggered by the creation of this file and the On-demand Program Settings, Exclusions.

You need to enter the path in both.
What have you entered in these and we can say if the path and syntax is correct.

system · 2007-05-05T07:17:10.000Z

File no longer treated as virus after todays update.
Thank you all for your help.

DavidR · 2007-05-05T13:02:24.000Z

Your welcome, thanks for the feed back, you can now remove the exclusions if you set them up for the file.

A belated welcome to the forums.

system · 2007-05-05T20:55:07.000Z

I am glad that you say that PC Tools Firewall has had a good review, like I mentioned yesterday, I have ran various tests from the Leak Test Website and it seemed to pass with flying colours.

Thanks for the welcome to this forum, it is a helpful tool for everyone.

DavidR · 2007-05-05T22:21:25.000Z

They weren’t reviews as such just avast users/forum members reporting that they had installed it instead of saw Zone Alarm or another one they were having issues with and found it to work well with avast, they liked the interface, etc. but not full blown reviews.

A google search for Review PC Tools Firewall might return some proper reviews.

Announcements