False positive: ImageShrink.exe

[saanvi]

Hi anybody. I renamed .exe into .log and attached it. This simple utility has no rootkits; I've used it on my site and visitors reporting that it contains a rootkit (when file checking by Avast! web shield).

[Coolmario88]

The log is giving me a popup when i try to look at it.. an avast popup (see pic)

[saanvi]

The log is giving me a popup when i try to look at it.. an avast popup (see pic)

There is no rootkit in this file - I've told that it's a false positive.

[true indian]

i have sent the sample as a FP to avast virus lab..lets see 

[saanvi]

i have sent the sample as a FP to avast virus lab..lets see 

Thanks, I just did it too.

[true indian]

can u upload the file here:

www.virustotal.com

and post the link to results here please.

[Coolmario88]

I have downloaded the file.. I uploaded it. 
http://www.virustotal.com/file-scan/report.html?id=81ae16f063cedad86fe2f63732dbd29e7764a58a6b4ba5d8fe523c9bb9124e1b-1325135834

the MD5 for virus total is: 65bf5ca5d39fbf509139cbd529644c8e    (Just incase the link doesn't work)

Also the file is detected by 13/ 43 antiviruses.

[true indian]

interesting results..lets see what the avast virus lab has to say about this.

[saanvi]

can u upload the file here:

www.virustotal.com

and post the link to results here please.

Here the results:

http://www.virustotal.com/file-scan/report.html?id=81ae16f063cedad86fe2f63732dbd29e7764a58a6b4ba5d8fe523c9bb9124e1b-1280262252

It's strange that Avast! didn't mark file as a suspicious. What "another" Avast! they have?

[true indian]

this seems to be a different file...did u upload the file that u gave us??

[saanvi]

Well, it's more and more interesting in comparing with Coolmario88cp results...

[saanvi]

this seems to be a different file...did u upload the file that u gave us??

No, the file is the same - md5 signature shows it. Just renamed extension.

[true indian]

can u attach the file in log format which u uploaded at VT

In that case avast catches it when it is in log format and not in exe format??

[Coolmario88]

this seems to be a different file...did u upload the file that u gave us??

No, the file is the same - md5 signature shows it. Just renamed extension.

Strange.. I didn't rename the file at all.

[true indian]

In that case avast catches it when it is in log format and not in exe format??

there seems to be something fishy...