Roboform false positive

Viruses and worms
1

Setup of the last version is giving a false positive :frowning:
http://www.roboform.com/download.html

Forgot to mention: Win2-Adware (gen) - [Adw]

2

Won’t you correct this ???

3

this FP should be fixed with next VPS update… :wink:

4

Thanks Maxx.

5

Tech, one little thing - the version 6.9.90 is not detected as Adware-gen… are you sure we’re talking about the same version? my MD5 is 6E375FA49EC1116DF936F68DCDA264F1

6

Sorry, I was talking about AI RoboForm 6.9.89.
MD5 0133FE27078C2602F87DC15C547C6760

It’s still being detected as infected.

7

oh, that’s the point of the misunderstanding… i’ll try to find the proper version :wink:

8

If you don’t find it… I can send it from Chest to you.

9

i’ve found the 6.9.89 with MD5 A213CD44586F8DF81DB53B706C02A85B only, which is not detected (is detected by VBA32 http://www.virustotal.com/cs/analisis/300e8b5685b471cf5c1f222b91404cb7)… send your file, pls :slight_smile:

10
11

I’m new here, please help me , my avast keeps popping up saying i am infected. I ran my cleaning tool and scanned , it said I was not infected so why wont my avast stop popping up ? What do i do please help me. This is my first PC.I’m lost. ??? :cry:

12

It would be better if you start a new thread to ask your questions. See the picture.

Anyway, I suggest:

  1. Disable System Restore and reenable it after step 3.
  2. Clean your temporary files.
  3. Schedule a boot time scanning with avast with archive scanning turned on. If avast does not detect it, you can try DrWeb CureIT! instead.
  4. Use SUPERantispyware, MBAM or Spyware Terminator to scan for spywares and trojans. If any infection is detected, better and safer is send the file to Quarantine than to simple delete than.
  5. Test your machine with anti-rootkit applications. I suggest avast! antirootkit or Trend Micro RootkitBuster.
  6. Make a HijackThis log to post here or, better, submit the RunScanner log to to on-line analysis.
  7. Immunize your system with SpywareBlaster or Windows Advanced Care.
  8. Check if you have insecure applications with Secunia Software Inspector.
13

Still being detected as infected…

14

Tech, I have just found 6.9.89 with md5:03D8382AA0B0EE8AAA7ACACE97023FC8 which is detected as Adware-gen, I hope this fix will help you. Fix will be released in next vps update.

15

Thanks, jsejtko.
Seems that I’m not being able to send files from Chest to Alwil for analysis. I’ve tried to send the executable a lot of times. Maybe gmail is blocking the .exe and .msi files to be sent ???

16

yes… gmail is quite offensive when truncating email attachments… it’s sensitive even for the file names under archives as you maybe know… jsejtko will handle your problem, i’ll be offline for a week…

17

Thanks for the info Maxx.
Enjoy your vacations :wink:

By the way, can’t the Chest send the files to analysis by a different method than email?
Why don’t you use ftp?

18

Hello Tech,

should I ask you if last update solved your problem with RoboForm?

About sending samples: The preffered way now is by using email, because it is fastest way. But you can submit samples to

ftp://ftp.avast.com/incoming

. But please notify us by email, or here in forum after you submit samples to ftp - what files were submitted. Thank you.

Regards

19

Not exaclty my problem :wink:
Yes, it’s solved.
I’ll use ftp when Gmail blocks sending .exe or .msi files next time. Thanks.