Win32/trojan (FS4.exe)

Viruses and worms
1

Ok i believed this to not be a trojan and chosen to repair itself, its in “C/Programs/FS4/FS4.exe” wanted to know your opinion about this exe file, if it should have high chances to be trojan or not.
For more info its a chinese rpg i installed that i love too much…

Edit: i went to the folder and keeps giving same message after repairing file :‘( it cant be a trojan… :’(

2

Upload the file to VirusTotal and post the results.

3

Hi Otaku Ichise,

Here it says it is safe: http://www.spywaredata.com/spyware/malware/fs4.exe.php
Prevx flagged it as malware since July 19th 2008, so it was added recently there. Could well be a FP.
Curious about what you get by uploading the file to VirusTotal?
DrWeb link checker returns an all green on: http://www.hongfire.com/forum/showthread.php?t=85238
I played this at my old Atari in the previous century,

Have a nice day, Nihon iti,

polonus

4

http://www.virustotal.com/pt/analisis/fa740be2be70d3ead7613a02e54d756a

ok but how will avast stop detecting him as a trojan now…

5

Hi Otaku Ichise,

That comes all naturally in a new update, you can update the file to avast also (info on their website how to), but the moderators read what is going on here, we are also part of their free laboratory, because this webforum works two ways - the avast evangelists learn more and more about security, and it is good for avast as well, you can put the file in the exclusion list until the new update comes where it is being fixed.

Here you see a message about a similar FP: http://vforums.mmoglider.com/showthread.php?t=145616

polonus

P.S. Yes it is sad that with the new av scanners there are more generic finds, so more good files get falsely tagged.

6
you can put the file in the exclusion list until the new update comes where it is being fixed.

Thank you very much for your help, sorry for the noob question but how do i do that? so he stops detecting it, will the update be here after some hours to download manualy?

7

Hello Otaku Ichise,

If it is indeed a false positive (and it looks that way), so add it to the exclusions lists:

Standard Shield, Customize, Advanced, Add and
Program Settings, Exclusions

I am refering to 2 separate exclusion lists

Standard Shield, Customize, Advanced, Add and
Program Settings, Exclusions

The first is the on access

Standard Shield, Customize, Advanced, Add

the second is the on demand

Program Settings, Exclusions

That is it,

polonus

8

I do that “On Acess control panel/ standard shield/ customize advanced/ then clickin on add/ i put C/Programs/FS4/FS4.exe” then at last “program setings exclusitions/ add C/programs/FS4/FS4.exe”.

Thank you very much for your quick and great assistance, im very gratefull.

Yours forever great team of Avast :slight_smile:

9

If you haven’t already done so you need to send the sample to avast so it can be analysed so that the virus signatures can be corrected.

Send the sample to virus@avast.com zipped and password protected with the password in email body, a link to this topic might help and possible false positive in the subject.

Or you can also add the file to the User Files (File, Add) section of the avast chest (if it isn’t already there) where it can do no harm and send it from there (select the file, right click, email to Alwil Software). No need to zip and PW protect when the sample is sent from chest. A copy of the file/s will remain in the original location, so any further action you take can remove that.