SimpleHelp detected as Win32:Evo-gen [Susp]

Viruses and worms
1

Hi, I am an IT support person and I use a program called SimpleHelp to assist remote clients with their computers. It is similar to Logmein and Teamviewer, although Simplehelp allows us to run our own server to distribute our host software for our clients. I give the client my Simplehelp server address and they access it as a web page and download the software needed for me to access their system. As of today 2/24/15 Avast is flagging the host software as Win32:Evo-gen [Susp] and deleting it before the client can run it. Needless to say this is not working out very well for me, since anyone who has Avast on their system cannot run my host software. The software is distributed by Simple-help.com, based in the United Kingdom. The host software is too large (about 10MB) for me to upload. What can I provide to you so this problem can be fixed? Thank you, Chuck Sadoian

2

Win32:Evo-gen [Susp] = suspicious is a on access detection only and will not show in any scan

Report it here https://support.avast.com/ > avast virus lab

you can test your file here www.virustotal.com / www.metascan-online.com if scanned before, click rescan for a fresh result

3

Hello,
you can provide us with the link to download the software from where you downloaded it.

Milos

4

Hmm, after I wrote that message the next morning I checked and Avast was now only complaining about the Simplehelp downloads on one of my machines. I removed Avast and reinstalled it, but it still was being zapped by Avast. I was about to throw in the towel and do a system recovery on the affected machine, assuming it was somehow infected with something that was screwing around with the TCP/IP stack. Before I did that I had to leave my office for about 3 hours and when I came back I tested again and everything was fine. Avast no longer was complaining about the Simplehelp files. The only thing I can think of is the latest virus definitions (150225-3) fixed the problem. Chuck

5

Milos,

The problem is back again today, possibly after the latest virus definitions were installed ( 150227-0).

I sent you a private message with the address of the simple-help server I maintain. You can download a trial version of SimpleHelp remote access software at this addresss:

http://simple-help.com/support

Thanks, Chuck