Avast WEBforum

Other => Viruses and worms => Topic started by: REDACTED on March 29, 2016, 07:38:31 PM

Title: FP: How to fix Win64:Evo-gen [Susp] on NSIS build installer?
Post by: REDACTED on March 29, 2016, 07:38:31 PM: Hi,

Downloads of our software installer from our website is blocked by Avast! protection.

Our software installer is build with NSIS version 3.0b3-1 under MSYS2+MINGW64 shell.

According to www.virustotal.com, Avast! suspect the presence of Win64:Evo-gen (database update: 20160329) in the installer. No problem is detected when checking our software (without the installer).

How to fix this? Filling a false positive form is not possible as our binary is > 10Mo...
Title: Re: FP: How to fix Win64:Evo-gen [Susp] on NSIS build installer?
Post by: Pondus on March 29, 2016, 07:45:00 PM: Quote
Avast! suspect the presence of Win64:Evo-gen (database update: 20160329) in the installer.
no, as Win64:Evo-gen [Susp] = Suspicious

Submitting False Positive https://www.avast.com/false-positive-file-form.php

if to big >> https://www.avast.com/faq.php?article=AVKB160

Contact avast support >> https://support.avast.com/support/tickets/new
Title: Re: FP: How to fix Win64:Evo-gen [Susp] on NSIS build installer?
Post by: Eddy on March 29, 2016, 11:39:58 PM: https://forum.avast.com/index.php?topic=180959.msg1280014#msg1280014

Compile the installer separately in all the compression types NSIS is using and check which one is giving the problem.
I suspect that ZLIB gives the problem.
Title: Re: FP: How to fix Win64:Evo-gen [Susp] on NSIS build installer?
Post by: Milos on March 30, 2016, 09:19:01 AM: Hello,
can you provide the link to virustotal scan results, please?

Thanks,
Milos
Title: Re: FP: How to fix Win64:Evo-gen [Susp] on NSIS build installer?
Post by: REDACTED on March 30, 2016, 08:13:26 PM: Quote
can you provide the link to virustotal scan results, please?

Here it is:

https://www.virustotal.com/fr/file/cc6a712710eec43d80bc1f8d35c9fa078f8e1d96a72ee812a7234c1f1d723585/analysis/
Title: Re: FP: How to fix Win64:Evo-gen [Susp] on NSIS build installer?
Post by: REDACTED on March 30, 2016, 08:26:57 PM: Quote from: Pondus on March 29, 2016, 07:45:00 PM
Contact avast support >> https://support.avast.com/support/tickets/new

Done. Thank you for the links.
Title: Re: FP: How to fix Win64:Evo-gen [Susp] on NSIS build installer?
Post by: REDACTED on April 06, 2016, 11:39:28 AM: Unfortunately Avast FTP server seems to be broken...

Downloads$ ftp ftp.avast.com
Connected to ftp.avast.com.
220 Welcome on ftp.avast.com.
Name (ftp.avast.com:matthias): anonymous
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> cd incoming
250 Directory successfully changed.
ftp> put myname@mycompany.com.zip
421 Service not available, remote server has closed connection
ftp: No control connection for command
Title: Re: FP: How to fix Win64:Evo-gen [Susp] on NSIS build installer?
Post by: REDACTED on April 06, 2016, 06:04:38 PM: Quote from: Eddy on March 29, 2016, 11:39:58 PM
https://forum.avast.com/index.php?topic=180959.msg1280014#msg1280014

Compile the installer separately in all the compression types NSIS is using and check which one is giving the problem.
I suspect that ZLIB gives the problem.

Done: Whatever the compression (zlib, bzip2, lzma) the setup is blocked!
Title: Re: FP: How to fix Win64:Evo-gen [Susp] on NSIS build installer?
Post by: jefferson sant on April 07, 2016, 01:41:57 PM: Open the menu Start-> Right click of the mouse->properties->remote settings
Make sure this box is checked
Allow Remote Assistance connections to this computer-> Press OK

not to interfere during the upload process disable resident protection temporarily

http://www.getavast.net/support/turn-off-shields

Download the winscp577.zip (https://cdn.winscp.net/files/winscp577.zip?secure=lGI_0meZk1Cwtmh-nxWk9w==,1460032528) portable and save to your desktop
decompress run WinSCP.exe

follow the instructions
https://www.avast.com/faq.php?article=AVKB160
Title: Re: FP: How to fix Win64:Evo-gen [Susp] on NSIS build installer?
Post by: REDACTED on April 08, 2016, 06:34:14 PM: Quote from: jefferson sant on April 07, 2016, 01:41:57 PM
(...) follow the instructions
https://www.avast.com/faq.php?article=AVKB160

Thanks. It's done: The file has been uploaded to Avast FTP server.
Title: Re: FP: How to fix Win64:Evo-gen [Susp] on NSIS build installer?
Post by: jefferson sant on April 08, 2016, 11:16:16 PM: Quote from: matthias.meulien on April 08, 2016, 06:34:14 PM
Quote from: jefferson sant on April 07, 2016, 01:41:57 PM
(...) follow the instructions
https://www.avast.com/faq.php?article=AVKB160

Thanks. It's done: The file has been uploaded to Avast FTP server.

Great.If the ticket was created you waiting for response customer service.What is the ticket number (ID)?
Title: Re: FP: How to fix Win64:Evo-gen [Susp] on NSIS build installer?
Post by: REDACTED on April 11, 2016, 12:15:45 PM: Quote from: jefferson sant on April 08, 2016, 11:16:16 PM
Great.If the ticket was created you waiting for response customer service.What is the ticket number (ID)?

https://support.avast.com/support/tickets/261775 (https://support.avast.com/support/tickets/261775)