my Repligo Viewer Infected?

[blinroth]

I used repligo viewer on my desktop for a long time and found nothing wrong with this.
but when just i scanned my pc with avast, a warning of Trojan flash out.

2007-9-15 23:28:03   Administrator   1236   Sign of "Win32:Wpepro-E [Trj]" has been found in "D:\Program Files\Cerience\RepliGo Viewer\RepliGoView.exe" file. 
2007-9-15 23:29:28   Administrator   3268   Sign of "Win32:Wpepro-E [Trj]" has been found in "D:\Program Files\Cerience\RepliGo Viewer\RepliGoView.exe" file. 
2007-9-15 23:29:49   Administrator   1236   Sign of "Win32:Wpepro-E [Trj]" has been found in "D:\PROGRA~1\Cerience\REPLIG~2\REPLIG~1.EXE" file. 
2007-9-15 23:50:23   Administrator   1236   Sign of "Win32:Wpepro-E [Trj]" has been found in "D:\Program Files\Cerience\RepliGo Viewer\RepliGoView.exe" file. 
2007-9-15 23:50:34   Administrator   1236   Sign of "Win32:Wpepro-E [Trj]" has been found in "D:\Program Files\Cerience\RepliGo Viewer\RepliGoView.exe" file. 

I uninstalled it, and downloaded a new version from the official site, but still avast warned of the same Trojan. So who can tell me, is this a mistake for avast or RepliGo viewer does include a trojan.

[DavidR]

You could also check the offending/suspect file at: VirusTotal - Multi engine on-line virus scanner I feel virustotal is the better option as it uses the windows version of avast (more packers supported) and there are currently 30 different scanners.

Or Jotti - Multi engine on-line virus scanner if any other scanners here detect them it is less likely to be a false positive. Whichever scanner you use, you can't do this with the file in the chest, you will need to move it out.


If it is indeed a false positive, add it to the exclusions lists (Standard Shield, Customize, Advanced, Add and Program Settings, Exclusions) and Restore it to its original location, periodically check it (scan it in the chest), there should still be a copy in the chest even though you restored it to the original location. When it is no longer detected then you can also remove it from the Standard Shield and Program Settings, exclusions.

Also see False Positives, how to report it to avast! and what to do to exclude them until the problem is corrected.

[blinroth]

thank you for your advice. I upload the file to "virustotal"

the report is like this

AhnLab-V3      2007.9.14.0/20070914    found nothing
AntiVir 7.6.0.10/20070914       found nothing
Authentium      4.93.8/20070916 found nothing
Avast   4.7.1043.0/20070915     found [Win32:Wpepro-E]
AVG     7.5.0.485/20070915      found nothing
BitDefender     7.2/20070916    found nothing
CAT-QuickHeal   9.00/20070915   found nothing
ClamAV  0.91.2/20070916 found nothing
DrWeb   4.33/20070916   found nothing
eSafe   7.0.15.0/20070916       found nothing
eTrust-Vet      31.1.5136/20070914      found nothing
Ewido   4.0/20070916    found nothing
F-Prot  4.3.2.48/20070916       found nothing
F-Secure        6.70.13030.0/20070916   found nothing
FileAdvisor     1/20070916      found nothing
Fortinet        3.11.0.0/20070916       found nothing
Ikarus  T3.1.1.12/20070916      found [Virus.Win32.Wpepro.E]
Kaspersky       4.0.2.24/20070916       found nothing
McAfee  5120/20070914   found nothing
Microsoft       1.2803/20070916 found nothing
NOD32v2 2533/20070916   found nothing
Norman  5.80.02/20070914        found nothing
Panda   9.0.0.4/20070916        found nothing
Rising  19.40.62.00/20070916    found nothing
Sophos  4.21.0/20070916 found nothing
Sunbelt 2.2.907.0/20070915      found nothing
Symantec        10/20070916     found nothing
TheHacker       6.2.5.060/20070914      found nothing
VBA32   3.12.2.4/20070916       found nothing
VirusBuster     4.3.26:9/20070916       found nothing
Webwasher-Gateway       6.0.1/20070914  found nothing

so i guess, avast made a mistake

[DavidR]

I think that it is likely to be an FP even though one other scanner picked it up.

Submit the file to avast as in the false positive link for analysis and correction. You can apply the exclusions so you can continue to use it.