Win32:Adware-gen. [adw]

Viruses and worms
1

I’m running the latest version of Avast;

  • Program: Already up to date
    (current version 4.7.871)
  • Vps: Already up to date
    (current version 0636-1)

I’m running an up-to-date version of XP Pro

The first incidence of Win32:Adware-gen. [adw] occurred on 8/23 when I downloaded a file called “recipes.exe” – Avast identified the file and it was put in the Virus Chest.

Last night, for the first time, in launching Vongo (movie download service), Avast identified Vongo.exe as having this virus. I was unable to do anything but remove it to the Virus Chest.

I searched Google for the file and acted upon a few of the suggestions, using Hijack This, CCleaner, Spybot Search & Destroy;

Then I Removed Vongo with Window’s “Add or Remove Programs,” downloaded the install program again from Vongo, reinstalled it, and got the same response from Avast.

I cannot determine if this is what is called a False Positive.

I have not tried to Restore Vongo.exe from the Chest and disable Avast in order to see if Vongo will run.

2

I have just read the post by “kempej01” --indicating that he (she?) has the same problem. I have tried to zip the file to no avail–but will attempt it again and if successful, send it off to Avast.

I’ll also attempt to restore it from the Chest and put Vongo on the exclusion list (is that really advisable?)

3

If you don’t need Vongo urgently leave it in the chest, you can’t zip flies in the chest, but they can be sent, right click the file and select’ email to Alwil Software and follow the instructions.

Monitor the other thread as if it is an FP it should get corrected fairly quickly.

4

Virus Chest respone:

The following file cannot be sent by email:
Vongo.exe (FileID: 79)
The file is bigger than the limit: 1024 kB

file is 4.7 meg

i do not have Outlook installed anyway…send everything through Google now.

suggestions?

5

Monitor the other thread and see if that is confirmed as a FP, assuming that check it against the multi-engine scanners virustotal and/or Jotti.

Or you could check the offending/suspect file yourself at: VirusTotal - Multi engine on-line virus scanner
Or Jotti - Multi engine on-line virus scanner if any other scanners here detect them it is less likely to be a false positive. You can’t do this with the file in the chest, you will need to move it out.

If it is indeed a false positive, add it to the exclusions lists (Standard Shield, Customize, Advanced and Program Settings, Exclusions) and check scan it periodically using the ashQuick scan (right click scan, it will need to be temporarily removed from the standard shield exclusions otherwise it won’t be scanned), when it is no longer detected then you can also remove it from the program settings, exclusions.