Uruguay 6/7/8

Viruses and worms
1

http://home.comcast.net/~Vash_T_Stampede/pol.JPG

When i was doing a virus scan it picked up this file as infected. Concidering its a pc game I was wondering if it was truely infected. I had my friend scan it with norton and others and none of them picked it up. Only Avast is seeing this as a virus. Im not sure if its a false reading on Avast, or if the other scaners arent picking it up. I recently formatted and this is off a direct install of the game. Any ideas?

This is the .dat uploaded to webspace.

http://home.comcast.net/~Vash_T_Stampede/55.DAT

Perhaps it will help you help me.

Thanks

2

If you are getting a virus warning that you believe is a false positive, then if you can zip and password protect (‘virus’, will do) the suspect file and send it to virus @ avast.com (no spaces).

Give a brief outline of the problem, the fact that you believe it to be a false positive and include the password in the body of the email. Some info on the avast version and VPS number (see about avast {right click avast icon}) will also help.

You could also check the offending/suspect file at: Jotti - Multi engine on-line virus scanner if any other scanners here detect them it is less likely to be a false positive. You can’t do this with the file in the chest, you will need to move it out.
Or VirusTotal - Multi engine on-line virus scanner

3

POSSIBLY INFECTED/MALWARE (Note: this file was only classified as malware by scanners known to generate more false positives than the average scanner. Do not consider these results definately accurate. Also, because of this, results of this scan will not be recorded in the database.)

AntiVir Found nothing
ArcaVir Found nothing
Avast Found Uruguay 6/7/8
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
Dr.Web Found nothing
F-Prot Antivirus Found nothing
Fortinet Found nothing
Kaspersky Anti-Virus Found nothing
NOD32 Found nothing
Norman Virus Control Found nothing
UNA Found nothing
VBA32 Found nothing

Ill zip it up and mail it to them as u suggested

4

Whitewinter, most probably (to not say absolutely sure), it’s a false positive.
Can you send the file to analisys from Alwil team?

5

i sent it to email that was decribed in the post above ziped and pwed like requested, will they email me back if it really is a false?

6

Thanks… Generally, there is not automatic answers.
This time (summer holidays) use to bring extra work for the virus analyst.
So, the best answers from them will be correcting the detection in virus database (VPS).
To you and until then, just add the file into the two Exclusions lists (Standar Shield Advanced tab of settings and on the Exclusion tab of program settings for on-deman scanning).
Wait a little (some days) and then check the file clicking the right mouse button and scanning it, when virus was not discovered, then you can remove the file from the exclusions lists. Sorry for the ‘extra’ work ::slight_smile:

7

:-\ so i wont ever be sure its a false positive?

8

Sure you will… They can answer you by email, or posting here in this thread (did you inform the link to this thread in your email?).
But, really, the best thing is correcting the program and changing the VPS. If you scan the file and it’s not detected as virus, so you could be sure it was a false positive 8)