Avast WEBforum
Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: havard on July 24, 2007, 09:05:48 PM
-
I just did a normal scan of my computer by using the latest updated Avast.
It reported that the file in \Windows\System32\autoconv. exe is infected by Win32:Adware-gen. I deleted the file and the Windows system reminded that a file related to the operation system had been changed and instructed me to insert the installation disc. I did so, and upon inserting the installation disc, the Avast was buzzing again.
The disc I inserted is an installation disc contained in the package provided by Dell. Therefore I would assume that this is false report by AVAST.
The operation system I am using is Windows XP Home of Simplified Chinese.
Here is the report provided by http://www.virustotal.com/
-----------------------------------
File autoconv.exe received on 07.24.2007 20:30:32 (CET)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED
Loading server information...
Your file is queued in position: 2.
Estimated start time is between 46 and 66 seconds.
Do not close the window untill scan is complete.
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file.
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated.
Print results
Your file has expired or do not exists.
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.
You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished.
Email:
Antivirus Version Last Update Result
AhnLab-V3 2007.7.25.0 2007.07.24 no virus found
AntiVir 7.4.0.44 2007.07.24 no virus found
Authentium 4.93.8 2007.07.23 no virus found
Avast 4.7.997.0 2007.07.24 Win32:Adware-gen.
AVG 7.5.0.476 2007.07.24 no virus found
BitDefender 7.2 2007.07.24 no virus found
CAT-QuickHeal 9.00 2007.07.24 no virus found
ClamAV devel-20070416 2007.07.24 no virus found
DrWeb 4.33 2007.07.24 no virus found
eSafe 7.0.15.0 2007.07.23 no virus found
eTrust-Vet 31.1.5003 2007.07.24 no virus found
Ewido 4.0 2007.07.24 no virus found
FileAdvisor 1 2007.07.24 no virus found
Fortinet 2.91.0.0 2007.07.24 no virus found
F-Prot 4.3.2.48 2007.07.23 no virus found
F-Secure 6.70.13030.0 2007.07.24 no virus found
Ikarus T3.1.1.8 2007.07.24 no virus found
Kaspersky 4.0.2.24 2007.07.24 no virus found
McAfee 5081 2007.07.24 no virus found
Microsoft 1.2704 2007.07.24 no virus found
NOD32v2 2417 2007.07.24 no virus found
Norman 5.80.02 2007.07.24 no virus found
Panda 9.0.0.4 2007.07.24 no virus found
Sophos 4.19.0 2007.07.17 no virus found
Sunbelt 2.2.907.0 2007.07.24 no virus found
Symantec 10 2007.07.24 no virus found
TheHacker 6.1.7.152 2007.07.23 no virus found
VBA32 3.12.2.1 2007.07.23 no virus found
VirusBuster 4.3.26:9 2007.07.24 no virus found
Webwasher-Gateway 6.0.1 2007.07.24 no virus found
Additional information
File size: 602624 bytes
MD5: 63bed50a7d8eb81ddd4ebaa3e4bf1fe9
SHA1: 94473162169c75a5b7021738586d9f86a393c052
------------------------------------------------------------
Anyone has similar experience today?
-
Send the sample to virus@avast.com zipped and password protected with password in email body and false positive/undetected malware in the subject.
Or you can also add the file to the User Files (File, Add) section of the avast chest where it can do no harm and send it from there (select the file, right click, email to Alwil Software). No need to zip and PW protect when the sample is sent from chest. A copy of the file/s will remain in the original location, so any further action you take can remove that.
If it is indeed a false positive (as it would appear), add it to the exclusions lists:
(Standard Shield, Customize, Advanced, Add
and Program Settings, Exclusions)
Restore it to its original location, periodically check it (scan it in the chest), there should still be a copy in the chest even though you restored it to the original location. When it is no longer detected then you can also remove it from the Standard Shield and Program Settings, exclusions.
-
This problem seems to have been fixed in the latest AVAST update. It does not display the alert now when scanning this file.
-
Thanks for the feedback.
They are usually quick in resolving a false positive when informed.
Welcome to the forums.