win32:Evo-gen [Susp] FALSE POSITIVE

Viruses and worms
1

Earlier today a programmer I am working on a project with compiled an updated dll for testing purposes. When the file was being downloaded to my computer via dropbox I began getting numerous alerts blocking the download (which were dropbox temp files at the time) and sending it to the virus chest. I later tried to download the file directly from the dropbox website but was stopped by avast again. I then restored the file from the chest and scanned it with avast: “No threat found”. I then uploaded the file to virustotal and scanned: “0/47 detections”

VirusTotal link: https://www.virustotal.com/en/file/f8ce45e200319745141601c6880159cd7f508ea82bf747c491546b1efe12ffc3/analysis/1383534588/

filename: newGame.dll
programming language: C#

We have been working on this program for over 6 months and have never had this issue before. I have sent both the dropbox temp file and the downloaded .dll to avast via the chest. I’ve also sent the file rar’d/pw’d to virus@avast.com with a short description.

Is there anything I can do to make avast ignore this file (or all dropbox downloads) while waiting for a detection fix?

2

Just discovered that I can have the file shield ignore the dropbox cache folder so I’ve added that as a temporary solution for the time being.

3

You can upload files and report issues to avast here : http://www.avast.com/contact-form.php (select subject according to Your case)

You can use mail
send to virus@avast.com in a password protected zip file
mail subject: False Positive / undetected sample (select subject according to your case)
zip password: infected

or you can send files from avast chest
how to use the chest. http://www.avast.com/faq.php?article=AVKB21

4

Hi, there. I have had those Problems with false positive, particually with win32:Evo-gen [Susp] ever once in a while. I am a service technican and get those messages ever once in a while with files that have a very low chance of being infected. Now i am trying to copy an older tool file (Alice 4.9 Access software) and Avast reports that above message again. Funny is that when i check the original file on my source hd it reports no infections wheras after the copy it reports the same file as infected and blocked.
I think this happens only in the never versions of Avast - i have not come across this in older versions.
I love avast specially because of its recognition rates. I have come across many infections even with up to date Antivirusprograms installed (I dont´t want to mention any names, there was one free program that i encountered in most cases which is used a lot in germany) but i remember no such things with avast. So i recommend Avast to all my clients as a first choice of Client Virus defence.
;D Good work guys at Avast!!