I just updated my “Avast” virus definitions and ran a scan and got several hits I presume these are false positives, here is a copy of the logs.
01/02/2008 5:08:34 PM Dennis 5400 Sign of "Win32:Agent-RNO [trj]" has been found in "C:\WinBuilder\Projects\Tools\WimUtil.exe" file.
01/02/2008 5:14:54 PM SYSTEM 1900 Sign of "Win32:Agent-RNO [trj]" has been found in "C:\WinBuilder\Projects\Tools\WimUtil.exe" file.
01/02/2008 5:30:28 PM Dennis 5400 Sign of "Win32:Agent-RNO [trj]" has been found in "K:\Downloads Jan 2 2008\VistaPe stuff\WinBuilder\Projects\Tools\WimUtil.exe" file.
01/02/2008 5:47:32 PM Dennis 5952 Sign of "Win32:Agent-RNO [trj]" has been found in "C:\WinBuilder\ISO\VistaPE.iso\sources\boot.wim" file.
01/02/2008 5:48:02 PM Dennis 5952 Sign of "Win32:Agent-RNO [trj]" has been found in "C:\WinBuilder\ISO\VistaPE.iso" file.
01/02/2008 5:48:54 PM Dennis 4420 Sign of "Win32:Agent-RNO [trj]" has been found in "C:\WinBuilder\Target\VistaPE\sources\boot.wim" file.
01/02/2008 7:17:54 PM SYSTEM 1964 AAVM - scanning warning: x_AavmCheckFileDirectEx [UNI]: C:\Windows\System32\conime.exe (C:\Windows\System32\conime.exe) returning error, 00000005.
You could also check the offending/suspect file at: VirusTotal - Multi engine on-line virus scanner and report the findings here. I feel virustotal is the better option as it uses the windows version of avast (more packers supported) and there are currently over 30 different scanners.
If it is indeed a false positive, add it to the exclusions lists: Standard Shield, Customize, Advanced, Add and Program Settings, Exclusions Restore it to its original location, periodically check it (scan it in the chest), there should still be a copy in the chest even though you restored it to the original location. When it is no longer detected then you can also remove it from the Standard Shield and Program Settings, exclusions.
Send the sample to virus@avast.com zipped and password protected with the password in email body, a link to this topic might help and false positive in the subject.
Or you can send it from the chest (select the file, right click, email to Alwil Software). No need to zip and PW protect when the sample is sent from chest. A copy of the file/s will remain in the original location, so any further action you take can remove that.
Hi guys, appreciate the help I am on dial-up so I sent the smallest file this is the result see below not picked up by too many others. Also one of the files that had a hit was VistaPe it was of course too large for me to upload.
