Possible false positive in World of Warcraft

Viruses and worms
1

Hi,

since today’s update of Avast (Version 4.8 Home Edition) I get the following warning when starting World of Warcraft:

Datei-Name: E:\WoW\Scan.dll
Malware-Name: Win32:Trojan-gen {Other}
Malware-Typ: Virus/Wurm

I’ve been using this Program for about 2 years on Win XP and there’s never been a warning concerning it. I also deleted the file and replaced it by the one of my roommate but again the warning popped up. As my roommate’s scanner, Avira Antivir Personal seems not to find anything, I suppose it’s a false positive.

Greetings, Tali

2

Hi,

I just posted in the false positive thread about that. I have the same problem on 4 computers that I have WoW installed on. It happened following last night update.

3

same here
OS is Win XP64
Uploaded the file to Virustotal, 2 of 36 hits

http://www.virustotal.com/analisis/2e159dc2fde5f919b2c46c541bdd26a6

4

Yeah, I came here for the same reason. I got 3 of 36 hits.

http://www.virustotal.com/analisis/dc986a07707d99e9f2cd32ce0bb94776

5

anyone sent it already in to tech support here for evaluation?

6

To be honest, I just wrote this posting… didn’t know what else to do cause I’m new at this :-[

7

ok, just mailed them the zipped file with the links to here and virustotal

8

I won’t hurt if more than one send in the sample for analysis.

If it is indeed a false positive and it seems so, see http://forum.avast.com/index.php?topic=34950.msg293451#msg293451, how to report it to avast! and what to do to exclude them until the problem is corrected.

9

Thanks for the help DavidR

just did that 1 min ago after reading your post in the other thread again

10

You’r welcome, Alwil are usually quick to correct an FP when identified.

11

Thank you for your advise :slight_smile: I now also emailed my files.

Meanwhile a GM in the WoW-Europe-Forum of Nera’thor where I first posted my problem gave an all-clear.
I also excluded the files from the avast scanner but I still get the warnings when I start WoW. So even if it’s supposed to be a false positive I would be really glad if it could be fixed.

12

I posted this in another thread pertaining to this topic but felt I should repost it here for others – a Blizzard poster posted the correct MD5 for the valid version of the file in THIS THREAD. Their copy of the file is 2B86BC28A32426105B6D7B8CBC5FABC1 – my version of the file matches this but Avast! still hits on it.

-X

13

this FP should be fixed already… :wink:

14

I just tried to update and it said I had the latest versions, yet I’m still getting the false positive.

15

that’s strange… can you retry it now?