Author Topic: Possible false alarm...how to know for sure?  (Read 2922 times)

0 Members and 1 Guest are viewing this topic.

WebMaximus

  • Guest
Possible false alarm...how to know for sure?
« on: February 03, 2012, 08:47:04 PM »
Downloading an addon program for MS Flight Simulator X called GSX from here -> http://www.fsdreamteam.com/products_gsx.html triggers an Avast! warning that the file is infected by a Trojan Horse called win32:Downloader-MUI [Trj]

I downloaded the same file a couple of days ago without any warnings from Avast! I asked about this in the support forum for the product and the developer was positive this was only a false alarm and adviced me to simply turn Avast! OFF before downloading and installing the software but I thought I want to ask in here first...

Is there any way for me to verify if this file I'm trying to download really is infected or if it's simply a false alarm?

WebMaximus

  • Guest
Re: Possible false alarm...how to know for sure?
« Reply #1 on: February 03, 2012, 08:57:28 PM »
Recieved another answer as below in the support forum for the product...

There's an easy way for you to be sure the file is the same as we distribute it, and is to check its Digital Signature, by right-clicking on the executable file, select "Properties", select the "Digital Signature" tab, click on "Details" and check if it's valid.

...and doing this the digital signature is reported as OK so I guess this confirms this is a false alarm by Avast?

Offline Asyn

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 76037
    • >>>  Avast Forum - Deutschsprachiger Bereich  <<<
Re: Possible false alarm...how to know for sure?
« Reply #2 on: February 03, 2012, 08:58:57 PM »
...and doing this the digital signature is reported as OK so I guess this confirms this is a false alarm by Avast?

You can report a possible FP here: http://www.avast.com/contact-form.php?loadStyles
W8.1 [x64] - Avast Free AV 23.3.8047.BC [UI.757] - Firefox ESR 102.9 [NS/uBO/PB] - Thunderbird 102.9.1
Avast-Tools: Secure Browser 109.0 - Cleanup 23.1 - SecureLine 5.18 - DriverUpdater 23.1 - CCleaner 6.01
Avast Wissenswertes (Downloads, Anleitungen & Infos): https://forum.avast.com/index.php?topic=60523.0

WebMaximus

  • Guest
Re: Possible false alarm...how to know for sure?
« Reply #3 on: February 03, 2012, 10:23:34 PM »
Thanks for the link, just reported the file as a possible false alert.

Offline Asyn

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 76037
    • >>>  Avast Forum - Deutschsprachiger Bereich  <<<
Re: Possible false alarm...how to know for sure?
« Reply #4 on: February 03, 2012, 10:25:51 PM »
Thanks for the link, just reported the file as a possible false alert.

You're welcome.
W8.1 [x64] - Avast Free AV 23.3.8047.BC [UI.757] - Firefox ESR 102.9 [NS/uBO/PB] - Thunderbird 102.9.1
Avast-Tools: Secure Browser 109.0 - Cleanup 23.1 - SecureLine 5.18 - DriverUpdater 23.1 - CCleaner 6.01
Avast Wissenswertes (Downloads, Anleitungen & Infos): https://forum.avast.com/index.php?topic=60523.0

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33897
  • malware fighter
Re: Possible false alarm...how to know for sure?
« Reply #5 on: February 03, 2012, 10:36:36 PM »
Hi WebMaximus and Asyn,

Here it is found clean, also by avast: http://vscan.urlvoid.com/analysis/056ab2d7bbf55507585031f37ca8edd1/cHJvZHVjdHMtZ3N4LWh0bWw=/
Given clean here as well: -http://jsunpack.jeek.org/?report=4da4fd7e9a6fb92d7085bfc87f92844c30182db4 (only visit this jsunpack link when security savvy, with ample script protection and in a VM)

polonus
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!