Author Topic: Really Nasty False Positive  (Read 4597 times)

0 Members and 1 Guest are viewing this topic.

Razenko

  • Guest
Really Nasty False Positive
« on: January 13, 2008, 11:34:26 PM »
Hi,

Just a moment ago I turned my PC on and Avast popped up saying my User32.DLL (A system file located in \Windows\System32\) contains a virus  :o, Win32:Trojan-gen to be exact.
This seemed a bit odd to me since I haven't done much with my PC today, except that Avast updated itself a moment ago and that virus warning popped up.
To test whether this was real or not I uploaded the file to http://virusscan.jotti.org/, and funny enough the only virus scanner to detect a virus was Avast, all the other 20 virus scanners detected nothing.
I also checked the dates of the file and it wasn't modified (It has the same date as on the Windows XP CD).
So I'm pretty sure that this is a false warning  ;), its just nasty that it is a Windows system file, a similar thing occurred to me a few months ago when AVG thought that one of my Windows files was a virus, and deleted it which resulted in Windows not booting up properly anymore, fortunately I managed to save my Windows installation, but its really annoying when a virus scanner, that supposed to protect you from viruses messing up your system,  actually is the cause of the whole ordeal  >:( .
Anyway, Some additional information:

File: USER32.DLL Version 5.1.2600.2180 (Windows XP Professional Dutch SP2)
Reported Virus: Win32:Trojan-gen (Other)
VPS Version: 080113-0, 13-01-2008

I hope this gets fixed ASAP   :)

« Last Edit: January 13, 2008, 11:41:54 PM by Razenko »

tls

  • Guest
Re: Really Nasty False Positive
« Reply #1 on: January 13, 2008, 11:45:30 PM »
Hi, Razenko

Have you reported it to virus@avast.com? 

see [Mini Sticky] False Positives, here:
http://forum.avast.com/index.php?board=2;action=display;threadid=7779

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11849
    • AVAST Software
Re: Really Nasty False Positive
« Reply #2 on: January 13, 2008, 11:50:49 PM »
First of all, please pack the file into a password-protected ZIP or RAR and send it to virus@avast.com (with "False positive" as subject).
Thanks.

Razenko

  • Guest
Re: Really Nasty False Positive
« Reply #3 on: January 14, 2008, 12:05:01 AM »
Quote
Hi, Razenko

Have you reported it to virus@avast.com?

Sorry  ;D,

Didn't know that, I will post it right now.

Thanks  :)