trojan detected in 3d driving school demo; FP?

Viruses and worms
1

I think it is a false positive because:

  1. 3d driving school is a legitimate product commercially available: http://www.3dfahrschule.de/uk_index.htm
  2. I obtained the the demo legally from the above website.
  3. I had it for over a year and hundreds of virus/malvare scans did report nothing.
  4. Avast reported it as a trojan only with the last update yesterday.

I can provide more details later as I’m at work now and had that thing on home PC.

2

Hi friendly_jacek, welcome to the forum :slight_smile:

Please could you upload the file to www.virustotal.com to confirm if it is a false positive and report back with the link to the results?
It may be the case that it has already been scanned, if so click on the
http://dl.dropbox.com/u/3105891/Pics/avast!%20pics/VT%20Reanalyse%20Now%20button.gif
button

You could also send the file in a password protected archive to virus(at)avast(dot)com with ‘potential false positive’ in the subject line and the password in the email body.

or

You could add the file to the user files of the virus chest and send it from there:

Right click avast icon in taskbar -->click start avast antivirus -->right click scanner background → click virus chest → navigate to user files → click add files →
right click file -->email to alwil software.

NOTE:
The file will actually be uploaded when the next update is performed (you can do a manual update to initiate the sending)

You could also add a link to this thread and some more information when you do.

If you have placed the file in the chest:

-Scott-

3

The demo file is 37MB so unless friendly_jacek can isolate the actual file avast is alerting on, friendly_jacek won’t be able to uplload to VT as there is a 10MB upload limit.

@ friendly_jacek
What is the infected file name, where was it found e.g. (C:\windows\system32\infected-file-name.xxx) ?
Check the avast! Log Viewer (right click the avast ‘a’ icon), Warning section, this contains information on all avast detections. C:\Program Files\Alwil Software\Avast4\ashLogV.exe

  • Or check the source file using notepad C:\Program Files\Alwil Software\Avast4\DATA\log\Warning.log and copy and paste the entry.
4

Hello,
I thing that the limit on VT is 20MB.

Milos

5

Yes thats right, there is also a new uploader, that allows 5 files at a time and has a drag and drop utility
http://www.raymond.cc/blog/archives/2009/12/14/virustotal-uploader-2-0-supports-uploading-up-to-five-20mb-files/

6

Hello,
if the detection name is “Win32:PdPinch-EI [Trj]”, it will be fixed in next VPS update.

Milos

7

Malwarebytes IP protection warning on ip 81.169.145.75

hxxp://www.3dfahrschule.de/uk_index.htm

8

Hello,
What’s gmgcjs?
Is it a Trojan or what? I have a question about avast! action in my computer as regards a certain file. Each time I switch on my computer, after some 20 - 40 minutes, I obtain a message from Avast! that a “suspicious” file has been found. The address is usually reported as:

C:\WINDOWS\System32\Drivers\gmgcjs.sys

Usually the recommendation is to “Ignore” and sometimes to delete the file. It than asks me to submit the file to Avast! laboratory. I always agree but I never got any reply. It asks me to scan all the local discs. Sometimes it says the file is of the type “ukryte usługi” which means “hidden services”. Sometimes it reports a Trojan in 1 or two files. But usually the search result is that “the number of infected files equals 0”. The problem is the scan takes a lot of time during which I cannot use my computer. And 40 minutes later you have the same once again.

I’ve only had this problem for about 4 weeks. I had used avast! home edition for over 2 years and about a week ago I upgraded to the Professional edition.

So my questions are : is gmgcjs a virus? Or is it some file in WINDOWS? How can this happen that if you delete that file in the WINDOWS catalogue, the same once deleted appears again? The message says it is dangerous - is it? Or should I answer to avast! "don’t inform me about this file again? (There is an option like that.)
Can one set avast! so that it deals with this problem automatically?
With best wishes
Julius_Z

9

errmm…oops…my bad :-[

10

That relates to if you send it in by email, http://www.virustotal.com/metodos.html or the new VT Uploader (if the user has it installed) as far as I’m aware, I can’t see anything that gives the limits for the web browser upload.

I can remember when the email limit was raised to 15MB and the web page limit was still 10MB so I don’t really know if that limit still applies as there is no way I would be uploading anything near that large on dial-up. I just see reports in the forum still about the 10MB limit when someone tries to upload something larger.

11

Yes it was!

What does it mean?
Also, if fixed then harmless, right?

12

If there is nothing else it will not be detected.

Also, if fixed then harmless, right?
Yes, if there is nothing else.

Milos