False Positive: World of Warcraft scan.dll

[Lougara]

I have had Avast classify the file C:\\programfiles\worldofwarcraft\scan.dll as a trojan virus, but this file is an in-program virus scanner.

I have tired placing the file in exclusions, but Avast still blares warnings at me as I try to play.


http://forums.worldofwarcraft.com/thread.html?topicId=12065147095&sid=1&pageNo=1

is a forum post with mulitple other Avast users having this issue.

Is there an ETA on when this file will be removed from the list of viruses?

[City Builder]

Yes, same situation here.  Blizzard staff informed me to report it to Avast and get them to make it so that file doesn't get detected wrongly in one of the next virus definition file updates.

Imagine 11 million possible users all getting told they have a virus in WOW, Insta-Panic... Oh Noes.... My accounts been keylogged.  There goes my purps 


Avast, please fix.

[Nykkida]

Oh thank God you posted this... I started playing yesterday, saw that warning this morning, and was just about to have a class A meltdown...

[DavidR]

You could also check the offending/suspect file at: VirusTotal - Multi engine on-line virus scanner and report the findings here the URL in the Address bar of the VT results page. You can't do this with the file securely in the chest, you need to extract it to a temporary (not original) location first, see below.

Create a folder called Suspect in the C:\ drive, e.g. C:\Suspect. Now exclude that folder in the Standard Shield, Customize, Advanced, Add, type (or copy and paste) C:\Suspect\* That will stop the standard shield scanning any file you put in that folder. You should now be able to export any file in the chest to this folder and upload it to VirusTotal without avast alerting.

Note the above process because I believe you are entering the exclusion in the Program Settings, Exclusions, which is for on-demand scans not on-access which would be detecting the file when you try to run it. If you also did that then if you entered this it is wrong C:\\programfiles\worldofwarcraft\scan.dll one too many backslashes and possibly it should be program files

If it is indeed a false positive, see http://forum.avast.com/index.php?topic=34950.msg293451#msg293451, how to report it to avast! and what to do to exclude them until the problem is corrected.

[madsentd]

I am getting this too.  This is the second time it has happened so I'm starting to think I need different AV software.  Come on avast! If 11 million people are playing this game, I bet a few million are using your product. Get it right.

[Rooterz]

I to have this problem with Scan.dll.new i dont know if its safe or not because avast goes crazy every time i try to logg into WoW but it still lets me play.

[DavidR]

Use the virustotal links and instruction I gave to confirm. I'm always suspicious at files with double file types like this .dll.new I tend to wonder why unless this is some form of update.

[dragonz]

Results

http://www.virustotal.com/analisis/fe146f93826c29d43b7a9abc8b43905c

[dragonz]

This problem with Scan.dll happened shortly after I installed Wrath of the Lich King addon (Scan.dll was last modified Nov 13th which is when i installed Wrath)


EDIT:

Using program 4.8.1282 & VPS 081116-1, Scan.dll & Scan.dll.new do not trigger a virus alert.

[DavidR]

Thanks for the feedback, it looks like someone has submitted the sample for analysis by avast and the VPS has been corrected. They usually are quick to correct if an FP is identified.