Author Topic: False Positive?!?!?? HL.EXE HLDS.EXE Half-life game files deleted by Avast.  (Read 25145 times)

0 Members and 1 Guest are viewing this topic.

Itsamario

  • Guest
So today when I started up a game which uses the hl.exe and hlds.exe half-life executable and half-life dedicated server executables respectively.
Avast promptly detected it as a Win32:Steam-AS [trj] Trojan Horse and for some reason deleted it without any of my input.
Here is a log of the multiple times it detected the executables as viruses.

1/15/2008 4:59:38 PM   SYSTEM   1444   Sign of "Win32:Steam-AS [trj]" has been found in "D:\program files\steam\steamapps\itismario\day of defeat\hlds.exe" file. 
1/15/2008 5:02:46 PM   SYSTEM   1444   Sign of "Win32:Steam-AS [trj]" has been found in "D:\program files\steam\steamapps\itismario\day of defeat\hl.exe" file. 
1/15/2008 5:03:34 PM   SYSTEM   1444   Sign of "Win32:Steam-AS [trj]" has been found in "D:\program files\steam\steamapps\itismario\day of defeat\hl.exe" file. 
1/15/2008 5:03:38 PM   SYSTEM   1444   Sign of "Win32:Steam-AS [trj]" has been found in "D:\program files\steam\steamapps\itismario\day of defeat\hlds.exe" file. 
1/15/2008 5:06:35 PM   SYSTEM   1444   Sign of "Win32:Steam-AS [trj]" has been found in "D:\Program Files\Steam\steamapps\itismario\day of defeat\hlds.exe" file. 
1/15/2008 5:17:43 PM   SYSTEM   1444   Sign of "Win32:Steam-AS [trj]" has been found in "D:\Program Files\Steam\steamapps\itismario\half-life\hl.exe" file. 
1/15/2008 5:22:26 PM   SYSTEM   1444   Sign of "Win32:Steam-AS [trj]" has been found in "D:\Program Files\Steam\steamapps\itismario\half-life\hlds.exe" file. 
1/15/2008 5:22:57 PM   SYSTEM   1444   Sign of "Win32:Steam-AS [trj]" has been found in "D:\Program Files\Steam\steamapps\itismario\counter-strike\hlds.exe" file. 
1/15/2008 5:22:59 PM   SYSTEM   1444   Sign of "Win32:Steam-AS [trj]" has been found in "D:\Program Files\Steam\steamapps\itismario\counter-strike\hl.exe" file. 

Is there a way to specifically stop Avast from deleting these certain files?
I would really like for Avast to mediate these false positives, as every single trace of the games' critical files are now lost and gone.
« Last Edit: January 16, 2008, 12:46:31 AM by Itsamario »

OldDevils.dk | sandman

  • Guest
Win32:Steam-AS [trj]

is a false positive,
PLZ fix it.

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67194
Man, it's becoming boring... why so much false positives these days?
The best things in life are free.

pstl

  • Guest
I'm having the exact same problem. I searched it on google and seen other people are as well, some in different languages as well. But all seem to be having the problem starting today, or been posting about the problem today. I don't know much about viruses but read some stuff about windows viruses that do something with files that start with "hl" and are bigger then 4 kb but smaller then 2mb and just spread throughout your system and network. It was on the symantec website search tool i searched hl.exe and got a different windows virus then the one that Avast's WIN32:Steam-AS [trj] definition. Here is the link to symantic search that i read http://www.symantec.com/security_response/writeup.jsp?docid=2003-020612-1237-99&tabid=2.At first i was like right my hl.exe is a virus but after reading that symantec thing, I'm not sure. Again I know nothing about viruses and what they can do I really don't want to reformat just so I know nothing is wrong, I'm almost positive that this is wrong or a false positive because i deleted the files and steam replaces them when you try to execute a game that needs those files. It still detects the new files steam downloaded as a virus, I'm probably just gunna tell avast to ignore those files but i would like someone who knows what they are talking about to confirm that this is no threat or give some input toward the problem. thanks

amikron

  • Guest
I would really like an update for this as well, I haven't touched my steam files in a few days and I wanted to run CS today, and avast was like "nah thats ok, bad stuff is going on here we gotta fix first" and I was like omg why avast!?

Avast decided to tell me "!!!!"

tcm112003

  • Guest
Hey, yeah, I've never had to use these forums other then now. I'm running into this problem as well. It is really annoying.

Come on Avast! You were good in my eyes until now. Come back to us!

Good thing Steam has a Auto-Updater which replaces those files, and the those files are not incredibly big.
« Last Edit: January 16, 2008, 03:49:13 AM by tcm112003 »

mac19406

  • Guest
Played this game 3 days ago... NO Problem!  Tried to play this game today... Virus message.

HELP!

tcm112003

  • Guest
I need a way to have avast ignore those two files (well with there instances in Day of Defeat, TFC, and Half-Life as well). Anyone want to show me how?

pstl

  • Guest
you can get them to ignore the files double clicking on your avast globe icon at the bottom of your screen next to your clock or open your avast program and go to standard shield then click customize and then advanced. Then click add and type in the path to the file C:\steam\steamapps\youremail@hotmail.com\counter-strike\hl.exe then click ok. I've been doing a scan and it is just going off about other files located in my steam folder as being viruses, like i said earlier i think this is just some kinda of screw up on avasts part because any problem associated with this begins today. I'm just gunna block mine and continue hopefully its nothing. I figure its either two things Avast is the only anti-virus program and internet source that knows about this Win32:steam-as trojan and steam is spreading viruses without knowing it (because i deleted the files and steam automatically replaces them when you try to play and avast still considers the newly replaced files a threat) or this is just a mistake from avast or as they call it a false positive. This is bummer but whatever ill just reformat if my system takes a dump. Hopefully avast doesn't keep telling me about my files because as I scan they just keep coming up each hl.exe for every game that uses it and different .gcf files as well. Good luck to everyone else, and I'm sure its nothing.

tcm112003

  • Guest
Okay I'll try that again. I thought it hadn't worked but if it does I'll do it.

nika

  • Guest
Hey.

I'm using Avast home edition 4.7. Virus database version 080115-0, and earlier this afternoon it said alot of my steam files (like hl.exe)were infected by this Win32:Steam-AS trojan. I already deleted my steam folder and am using my laptop until Im sure theres no problem, but Ive seen alot of people (on the steam forums, for example) say its a false positive. Is it something i should worry about?  ???



tcm112003

  • Guest
it is a false positive. Pause the Standard Scanner when trying to start the games that run with hl.exe and you'll be fine. Just remember to start it again when your done playing or you'll be out in the open.
« Last Edit: January 16, 2008, 06:14:29 AM by tcm112003 »

Offline Maxx_original

  • Moderator
  • Super Poster
  • *
  • Posts: 1479
fixed.. update your VPS ;)

nika

  • Guest
oh, then its really not a virus? phew  8)

tcm112003

  • Guest
ty vm :) glad it was fixed fast.