Removing false positive from chest

Avast Free Antivirus / Premium Security
1

RE: 10/5/2010 9:43:53 AM C:\Program Files\Common Files\Pure Networks Shared\Platform\AVManagerUnified.dll|>[UPX] [L] Win32:Malware-gen (0)
File was successfully moved to chest…

I googled “AVManagerUnified.dll,” found that it is a false positive and submitted it as such via Avast’s “Report file as false positive” function. Then found virus chest at “C:\Documents and Settings\All Users\Application Data\Alwil Software\Avast5\chest.”

The chest folder contains two files: an index.xml and a file named “00000001” which I assume is AVManagerUnified.dll, renamed for security. How do I transfer the file back to where it should be with the correct name so Pure Networks’ Network Magic program functions?

Thanks.

2

You can’t work with files from outside the chest, as you see it a) changes the name and b) the file is encrypted, both of witch go toward the avast chest being a protected area. You have to open the chest and work from within.

This however, is pointless as restoring a file considered infected would simply result in it being put back in the chest.

You could also check the offending/suspect file at: VirusTotal - Multi engine on-line virus scanner and report the findings here the URL in the Address bar of the VT results page. You can’t do this with the file securely in the chest, you need to extract it to a temporary (not original) location first, see below.

Create a folder called Suspect in the [b]C:[/b] drive. Now exclude that folder in the File System Shield, Expert Settings, Exclusions, Add, type (or copy and paste) C:\Suspect*
That will stop the File System Shield scanning any file you put in that folder.

If only GData and avast detect it - GData uses avast as one of its two scanners so counts as 1 detection and almost certainly an FP.
Send the sample to avast as a False Positive:
Open the chest and right click on the file and select ‘Submit to virus lab…’ complete the form and submit, the file will be uploaded during the next update.

  • In the meantime (if you accept the risk), add the full path to the file to the exclusions lists:
    File System Shield, Expert Settings, Exclusions, Add and
    avast Settings, Exclusions

Restore it to its original location, periodically check it (scan it in the chest), there should still be a copy in the chest even though you restored it to the original location. When it is no longer detected then you can also remove it from the File System Shield and avast Settings, exclusions lists.

3

Thanks for the feedback. Very thorough.

After restoring AVManagerUnified.dll from within the chest, uploaded it to http://www.virustotal.com/. Results stated, in part, “0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware.” URL is http://www.virustotal.com/file-scan/report.html?id=0519f2a13c2646a3308f6556a6d4ee771e19cbf0437c1539a381d747e9b43b3a-1286316070. Added anonymous comment that, “Identified by avast! Antivirus as malware.”

Finally, restored it to its original location. Already submitted to virus lab.

4

You’re welcome.