Author Topic: False positive - SuperAntiSpyware.exe  (Read 20565 times)

0 Members and 1 Guest are viewing this topic.

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88899
  • No support PMs thanks
Re: False positive - SuperAntiSpyware.exe
« Reply #15 on: May 26, 2008, 08:12:09 PM »
You can click ignore until you are blue in the face, avast won't let you run what it classes as an infected file period. So it hasn't broken SAS. The ignore relates to that particular detection only. It doesn't matter what version of avast you are using as it is a signature based detection and not a version based detection.

I would first ensure that you have the latest version of SAS even though you downloaded it last week. Uninstall the current version and install the latest version, if still detected continue with the steps below.

To get it to work you would have to exclude it from scans, however I would ensure that you have checked it is a bad detection by sending to virustotal. Then if proven to be an FP and only then should you exclude it from scans and send it to avast for analysis.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Rick F

  • Guest
Re: False positive - SuperAntiSpyware.exe
« Reply #16 on: May 26, 2008, 08:31:50 PM »
Thanks David,

Well, I tried to upload the file to both Virustotal and Jotti.  It keeps telling me "O bytes uploaded".  Jotti told me it's probably my Firewall (ZoneAlarm). I turned off Zone Alarm, but still get the same thing, "O bytes uploaded". I think since avast modified it someway, I can't upload it... but not sure. 

I downloaded and installed SAS on May 18th, but I see from visiting their site that the latest version is now 4.1.1046.  I have 4.0.0.1154.

What version do others have that is being detected by avast??

Thanks.

Rick F

  • Guest
Re: False positive - SuperAntiSpyware.exe
« Reply #17 on: May 26, 2008, 08:48:33 PM »
Well, since I couldn't upload the suspected file (SuperAntispyware.exe), I uploaded the installation file -- all 6 meg of it to VirusTotal.  It said it had already been analayzed.  Nothing found... even Avast says it's not infected? BUT... the install file is packed so not sure if this is a good test or not.

Edit......

Also uploaded it to Jotti.  Jotti unpacked and nothing found... even avast says clean.  ???
_________

BTW, I added the path of SAS to avast's exclude list and I still can't launch SAS.  Says not 'appropriate permissions'.
« Last Edit: May 26, 2008, 08:57:40 PM by Rick F »

Rick F

  • Guest
Re: False positive - SuperAntiSpyware.exe
« Reply #18 on: May 26, 2008, 09:18:39 PM »
Okay, I decided to uninstall SAS (SuperAntiSpyware 4.0.0.1154) and install the latest (4.1.1046).  During the uninstall, avast still sounded the alarm saying infected with sign of "Win32:Trojan-gen {Other}".  Even though I thought I excluded it from detection by avast, it still sounded the alarm.

Quote
Warning Log:

5/26/2008 2:58:35 PM   Rick   1924   Sign of "Win32:Trojan-gen {Other}" has been found in "C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE" file.
 

Update...

FYI: Installed the newest version of SAS (4.1.1046) and all is fine.  Runs without avast detecting as trojan present.  ;D
« Last Edit: May 26, 2008, 09:48:26 PM by Rick F »

coolcreator

  • Guest
Re: False positive - SuperAntiSpyware.exe
« Reply #19 on: May 26, 2008, 09:51:32 PM »
I know that this is off-topic, but I looked through the other boards and cannot find any other way to ask this question! *sighs* I apologize in advance.

How is it possible to contact another user or ask them a non-avast!-related question on here????? Is it possible??? I see that they have disabled the PM function.

I normally would just assume people wish to remain anonymous, but I'm sure that the person I want to ask something of would be tickled if my assumptions are correct.

Rick F has a euphonium photo as his icon. It made me wonder if he's a euphoniumist. If so, he'd probably get a kick out of who my father is.  :o 

Again, I'm sorry if I have inconvenienced anyone with this question.

Rick F

  • Guest
Re: False positive - SuperAntiSpyware.exe
« Reply #20 on: May 26, 2008, 10:08:05 PM »
Hi,

I sent you a PM with my email address (don't want to post here in forum view).

To send a PM just click on the user's name and you should see that choice.


Rick F

  • Guest
Re: False positive - SuperAntiSpyware.exe
« Reply #21 on: May 26, 2008, 10:25:39 PM »
coolcreator,

Deleted content
« Last Edit: May 26, 2008, 10:27:10 PM by Rick F »

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88899
  • No support PMs thanks
Re: False positive - SuperAntiSpyware.exe
« Reply #22 on: May 26, 2008, 11:05:44 PM »
<snip>
To send a PM just click on the user's name and you should see that choice.

Forum members with less than 20 posts can't use the PM function.

This is a restriction to avoid what happened in the past people joining the forum and spamming the PM function. After 20 posts it can reasonably be assumed that they aren't drive by spammers.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Rick F

  • Guest
Re: False positive - SuperAntiSpyware.exe
« Reply #23 on: May 26, 2008, 11:18:00 PM »
Quote
David wrote:

Forum members with less than 20 posts can't use the PM function.

This makes sense.

The user was able to contact me via email as I sent them my email addy in a PM to that user.

Thanx David.


Daffy

  • Guest
Re: False positive - SuperAntiSpyware.exe
« Reply #24 on: May 26, 2008, 11:18:36 PM »
I too have exactly same problem with SAS and Avast.
Uninstalled SAS, and Avast got quiet.
I do suspect it's Avast who causing the problem and not SAS,
because I only run SAS once a week, and today was the day.
I didn't even get a chance to start it.  ???
Ignored the warning, restarted, and now Avast really gets mad.
Moved to chest, and now SAS didn't work.

I use Vista Home Premium.
Avast was fully updated.

I want to know if or when it's OK to install SAS again.

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88899
  • No support PMs thanks
Re: False positive - SuperAntiSpyware.exe
« Reply #25 on: May 26, 2008, 11:32:10 PM »
Read what I said in http://forum.avast.com/index.php?topic=35821.msg300959#msg300959 reply #15 above.

Also ensure you have the latest version of SAS as this isn't an issue with the latest version.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline Maxx_original

  • Moderator
  • Super Poster
  • *
  • Posts: 1479
Re: False positive - SuperAntiSpyware.exe
« Reply #26 on: May 26, 2008, 11:35:34 PM »
the new VPS update is almost ready to go... hopefully it will solve this problem for all of you ;)

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88899
  • No support PMs thanks
Re: False positive - SuperAntiSpyware.exe
« Reply #27 on: May 27, 2008, 12:29:45 AM »
Thanks, Maxx, strange that this only seems to effect the old version of SAS.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline Abraxas

  • Avast Evangelist
  • Advanced Poster
  • ***
  • Posts: 730
  • Perseverance Furthers...
    • PCLinuxOS-Forums
Re: False positive - SuperAntiSpyware.exe
« Reply #28 on: May 27, 2008, 03:42:01 AM »
Problem solved , good work people  :)
I suspect once SAS loads into memory during boot Avast! detected it and set off the alarm bells .
I have totally uninstalled SAS , and asDavidR and Rick F suggested installed newest version of SAS (4.1.1046) and all is fine.
the new VPS update is almost ready to go... hopefully it will solve this problem for all of you ;)
Yes , all is fine this end now !

crococ

  • Guest
Re: False positive - SuperAntiSpyware.exe
« Reply #29 on: May 27, 2008, 12:24:53 PM »
Hello all,

Thanks for the info I could get in this thread about the SAS problem. The situation could
be repaired on my both machines by completely removing SAS and install the 4.1.1046
version (I do not remember what was the preceeding one causing the problem).

So it looks to me as if it was a SAS issue, even if in the meantime there was a Avast VPS
update, and even if I have no idea of the detailed and real cause of the FP detection.