Author Topic: FalsePositive? - Avast blocked Ragnarok Online 2  (Read 2378 times)

Offline gblu

  • Full Member
  • ***
  • Posts: 104
  • Gender: Female
    • Personal Message (Offline)
FalsePositive? - Avast blocked Ragnarok Online 2
« on: November 29, 2013, 02:51:21 PM »
i always get this warning when i try to launch ragnarok online 2 (indonesia server). it said, web shield blocked a harmful webpage or file. i can't play the game because avast blocked it.

infection: fileRepMetaGen (malware)
process : ragnarok online 2\shipping\dfcg\delphine.upd
url : h**p://dcfg.ragnarok2.lytogame.com/ragnarok21/201311/RO2_FIX.exe.1009


this always happens after i got new updates for the game (patch 20 november 2013). 
Intel E6300 Dualcore2 - 3GB RAM - GeForce 9400GT - WIN XP SP3 - AVAST! free - MBAM - Firefox  -  CCleaner

Toshiba NB520 - Win Seven Starter - AVAST! free

Offline Michael (alan1998)

  • Super Poster
  • ***
  • Posts: 1245
  • Gender: Male
    • Personal Message (Offline)
Re: FalsePositive? - Avast blocked Ragnarok Online 2
« Reply #1 on: November 29, 2013, 05:49:58 PM »
Hi,

If you can, please test the file @ www.virustotal.com.

Also, Please post that link about make SURE you keep the link INACTIVE to protect the users. Then I can ask polonus to do a detailed scan of that website and see what's up with it. If it turns out to be legit then in the next VPS update they will probably fix that...
i7-3770, GTX 760DCII OC, 16GB DDR3 RAM @ 1600Mhz, 2TB HDD @ 7200RPM, 32GB SSD.

Online polonus

  • avast! √úberevangelist
  • Maybe Bot
  • *****
  • Posts: 20143
  • Gender: Male
  • malware fighter
    • Personal Message (Online)
Re: FalsePositive? - Avast blocked Ragnarok Online 2
« Reply #2 on: November 29, 2013, 09:08:08 PM »
This is an avast! File Rep alert. It probably means that those files did not come signed.
This is considered when flagging the File Rep Alert:

1. File Data changes (Emergence)
2. Number of computers, that executed that file (Prevalence)
3. Source URL
4. Status of the digital signatures

polonus
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline gblu

  • Full Member
  • ***
  • Posts: 104
  • Gender: Female
    • Personal Message (Offline)
Intel E6300 Dualcore2 - 3GB RAM - GeForce 9400GT - WIN XP SP3 - AVAST! free - MBAM - Firefox  -  CCleaner

Toshiba NB520 - Win Seven Starter - AVAST! free

Offline Steven Winderlich

  • Super Poster
  • ***
  • Posts: 1832
  • Gender: Male
  • Happy Easter :)
    • Personal Message (Offline)
Re: FalsePositive? - Avast blocked Ragnarok Online 2
« Reply #4 on: November 30, 2013, 02:39:25 PM »
File looks clean (First submission 2013-08-04 20:14:09 UTC ( 3 months, 3 weeks ago )).

Please report it to Avast.

Send the file to virus@avast.com Subject: False positive.
Windows 8.1 Update 1 64-Bit, Avast 2014 Free 9.0.2018, Malwarebytes 2 PRO, MCShield

Online polonus

  • avast! √úberevangelist
  • Maybe Bot
  • *****
  • Posts: 20143
  • Gender: Male
  • malware fighter
    • Personal Message (Online)
Re: FalsePositive? - Avast blocked Ragnarok Online 2
« Reply #5 on: November 30, 2013, 04:19:38 PM »
This is one of the files analysed at Anubis: http://anubis.iseclab.org/?action=result&task_id=137f18d2ea0355a049d899edc4b3f19c7&format=html
I see no issues there,

polonus
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

 

Google Chrome

AVAST recommends using the FREE Google Chrome™ browser.

Download Google Chrome Now