WinMerge-2.14.0-Setup.exe and Win32:Rootkit-gen

Avast Free Antivirus / Premium Security
1

I have downloaded WinMerge-2.14.0-Setup.exe from http://winmerge.org

Avast 2015.10.0.2208, virus definitions 150208-1, is reporting the downloaded file as:
Win32:Rootkit-gen

Can anyone confirm this to be a problem, or is it a false positive?

2

I can confirm the FP please report to Avast

3

How do I report this to Avast? I can’t find how in the Avast UI?

4

Right click on the file in the virus chest and select “Submit to virus lab”. After filling out the required information, right click on your avast tray icon and select update > “Engine and virus definitions”, so that the report is sent to Avast.

You can also report online here: https://www.avast.com/en-us/contact-us.php?subject=VIRUS-FILE

5

OK, thanks. Submitting file now…

6

I have tried to report this as an FP from the download and avast alert interface. See attached image.

@ Sutieday
If it is the web shield alerting then it won’t be in the virus chest - so it can’t be sent from there.

Neither can it be reported from the on-line form, if reporting an FP on a file it wants you to upload the file (you might not have it). You would have to report an False alert on a website expand to include the full path to the file.

I have reported this including the URL of this topic.

7

I downloaded it and the .crdownload file was in the chest. Also the op can temporarily disable avast and submit it through the online forum. Also if any Avast staff see this post they could possibly fix the FP.

8

Personally I wouldn’t advise an avast user to disable avast to download a suspect file. We don’t know their level of experience or what system alternative protection they might have (VM or sandboxed system environment).

9

This appears to be legitimate software so I see no reason to worry. However if it was malicious then I see why you would advise against disabling AV.

10

Detection will be turned off in next stream update

11

Appearances can be deceptive so until there is 100% clarity users shouldn’t be advised to disable avast. In something like this time really isn’t super urgent - once reported and a sample sent avast are quick to correct an FP when confirmed. As can be seen by the reply by one of the avast virus labs team.

Thanks for the prompt response.