Problem trying to send possible FP to Avast

[Geoffo]

I have a file (MFME11.exe) which flagged up this morning as having a Win32:Malware-Gen virus. This is a 'one-armed bandit' game that I have been playing for the last 6 years. I uploaded the file to VirusTotal and 7 out of 32 said it was a virus (Authentium, Avast, Comodo, F-Prot, F-Secure, GData and Jiangmin). I'm fortunate that I have the original CD that this file was on - so when I scanned this on the CD and it also flagged as a virus, I became convinced that it must be a false positive. I've also run an avast bootscan, MBAB and SuperAntiSpyware

The problem I am having is sending this infected file to Avast. When I try to send from within the Chest, nothing happens at all - either clicking the icon or right-click 'Send email to Awil' both is just as if I haven't clicked at all. I tried extracting to a created folder C:\Suspect, zipping this and then attaching in an email, but when I send (in Outlook Express), the virus alarm sounds and I am prevented from sending.

Any help appreciated. I am running Avast Home 4.8.1368

Geoff

[scythe944]

I never have to do this, but I've read about it before.  I'm pretty sure that Avast won't really tell you that it did anything when you complete the "email to alwil" (of course, it doesn't actually email them, it just uploads it to them the next time you do a VPS update).

You should get the form to submit the False Positive though.  If the form isn't popping up, then something's wrong, but I don't remember the fix.  I believe you're supposed to try a repair of Avast, but don't hold me to it.

As for creating the folder and sending from there, did you add that folder to the exclusions list?  If so, you may have to turn off your mail scanner, but I don't think you should have to do that if it's in the exclusions list.

[spg SCOTT]

I have experienced this myself. I have found that if the file is quite large, and bigger than the sending limit, it will not be sent.

in the chest, right click the file and click properties, it will give you a value for size, in bytes...

what you then have to do is:
right click avast! tray icon --> program settings --> chest

change the 'maximum size of file to be sent' to fit the file. (it is in kilobytes, so you will need to convert it to kilobytes - divide by a thousand)
round the size up a bit, to give you some leeway...


As for the zipped file, it is most probably because it is not password protected, so avast! scans it and blocks it...
For password protected archives, I use 7zip www.7zip.com

Except that I use the portable version. This means that it is not installed normally and is contained in a single folder of your choosing, so that if/when you want to get rid of it, you can just delete the folder. I find this much easier than installing the program normally

It can be found here (if you are interested): http://portableapps.com/apps/utilities/7-zip_portable

-Scott-

[Geoffo]

You are brilliant Scotty. My file is 1082kb and the default in Prog Settings Chest is 1024kb - so I changed this to 2048kb and it worked. Thanks for your help & great advice.

[Milos]

Hello,
thank you for sending sample (email arrived and through the avast dialog too). False positive will be fixed in next VPS update.

Milos

[scythe944]

cool.. thanks for the info too Scott, hopefully I'll be able to remember it for the next time.

[spg SCOTT]

You're welcome Geoffo, scythe

-Scott-