Since updating to the latest virus definitions a few days ago, Avast has been reporting that my notepad.exe is infected with a trojan (Win32:Trojan-gen) and moved it to the virus chest. I was suspicious that this might be a false positive so I uploaded the file to virustotal & a few other sites and only Avast and GData (which uses Avast as one of it’s scanners) report it as a virus while all the other scanners say it’s clean. With this knowledge in hand, I sent the file to the Avast virus lab about 20 hours ago and have yet to hear anything from anyone about it so I thought I would also make a post here to see if there were any updates to this issue.
I have the Brico packs installed from crystalxp.net which may account for the different file sizes (and possibly the MD5’s as well) and from your link it is saying your version is confirmed maleware, but that is besides the point. All I want to know is if my version is really infected or is Avast just throwing off the alert because the filesize is different then the reg filesize or some other reason. I need to get this taken care of one way or another asap.
No a single detection is hardly confirmation and usually considered an FP, more so if there is a detection from a lesser known AV.
In your case you are going to have to send the sample to avast for further analysis. If this has been on your system for some time and is only now detected it is possibly that it is an FP as the Win32:Trojan-gen is a generic signature and also gdata uses avast as one of its two scanners, so yours is effectively only one detection.
Send the sample to avast as a False Positive:
Open the chest and right click on the file and select ‘Submit to virus lab…’ complete the form and submit, the file will be uploaded during the next update.
In the meantime (if you accept the risk), add the full path to the file to the exclusions lists: File System Shield, Expert Settings, Exclusions, Add and avast Settings, Exclusions
Restore it to its original location, periodically check it (scan it in the chest), there should still be a copy in the chest even though you restored it to the original location. When it is no longer detected then you can also remove it from the File System Shield and avast Settings, exclusions lists.
If you don’t accept that risk, you could use another text editor for the time being (I use editpad lite as my text editor of choice) whilst it is being analysed.
I did submit the file to the lab (as I said in my OP) about 22 hours ago now and still no response from the avast folks which is why I started this topic.
You don’t normally get a reply to your submission from the chest or if you emailed it unless they need more info.
You need to do as I mentioned, in relation to excluding and restoring the file:
Restore it to its original location, periodically check it (scan it in the chest), there should still be a copy in the chest even though you restored it to the original location. When it is no longer detected then you can also remove it from the File System Shield and avast Settings, exclusions lists.
One of the avast team replied in the forums in a little over 30 minutes, albeit to ask a question. However, with the other replies you should be able to work round this until the file is analysed and if conformed an FP a correction issued in the next available virus definitions update.
They are usually quite quick in correcting the signature after analysis when they confirm it is an FP. They don’t white list the file as such (as far as I’m aware) but modify the signature which was a generic one designed to catch more than one variant.
Hello,
from the screenshot I see that avast! is detecting “notepad++.exe” not “notepad.exe”. Send the file to virus@avast.com and put “false positive” to email subject.
