Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: RTI on November 01, 2007, 11:48:36 PM

Title: AVAST kills LogMeIn software
Post by: RTI on November 01, 2007, 11:48:36 PM
This afternoon's update killed logmein remote software.  Latest database classifies LogMeIn as malware.  This needs to be fixed! Has cost customers hundreds of $!
Title: Re: AVAST kills LogMeIn software
Post by: cesanne on November 01, 2007, 11:53:21 PM
Same experience.  Please correct ASAP.
Title: Re: AVAST kills LogMeIn software
Post by: Maxx_original on November 01, 2007, 11:53:52 PM
ook.. but we need to know more infos... can you post here the url of the software and send the particular file in a password protected archive to virus[at]avast[dot]com? fill in "false positive" as a subject..
Title: Re: AVAST kills LogMeIn software
Post by: RTI on November 01, 2007, 11:57:45 PM
The website is www.logmein.com and it detects several files.  LMIPORT.dll and LMIFSCLIENTNP.dll  It is causing the computers to run extremely slow.  I have had both running well together until today's update.  The LogMeIn forums are starting to talk about it as well.
Title: Re: AVAST kills LogMeIn software
Post by: Maxx_original on November 02, 2007, 12:07:02 AM
add the lm* files from the program directory to exclusions temporarilly and wait for the next VPS... we will fix that FP and add the files to our cleanset..
Title: Re: AVAST kills LogMeIn software
Post by: rdmaloyjr on November 02, 2007, 12:12:12 AM
I'm using logmein right now to make this post from my remote controlled computer, I'm not having any problems.  I have the latest avast! update.  No pop ups from avast!.  I haven't run an on demand scan with avast! though.
Title: Re: AVAST kills LogMeIn software
Post by: cesanne on November 02, 2007, 12:31:04 AM
LogMeIn is available at logmein.com.  (LogMeIn, Inc. was formerly known as 3am Labs, Inc., the developer of RemotelyAnywhere.)  LogMeIn is a very secure commercial remote control/access software available in multiple versions and continuously updated.  (The software is available free with the service; a free version of service is also available.)

I had a client today on whose computer Avast popped up multiple different messages regarding different LogMeIn files, including "LMIport.dll" located in in the Windows\System32 folder which it called "Win32:Agent-MVH [Rtk]"

On my computer, Avast stopped on "LMIRfsClientNP.dll" located in same folder, calling it a 'Rootkit' ("Win32:Lmir-PG [Rtk]")

Upon attaching files, Avast stopped on two more in same (System32) folder:
"LMIinit.dll" labelled "Win32:Vundo-gen53 [Adw]" and
"LMImirr.dll" labelled "Win32:Lmir-PF [Rtk]"

The VPS version is 071101-0, 11/01/2007
I would upload files, but Avast has apparantly blocked access.  I will boot with util disk to get.
Title: Re: AVAST kills LogMeIn software
Post by: rdmaloyjr on November 02, 2007, 12:57:36 AM
I'm using the free version of logmein remote & avast! 4.7.1074, VPS version is 071101-0, 11/01/2007.
No problems. :)
Title: Re: AVAST kills LogMeIn software
Post by: aj8690 on November 02, 2007, 02:03:11 AM
This is a big problem!  I have Avast and LogMeIn installed on many clients' PCs and I have been getting calls all day "HelP!!! My computer has a virus!!" 

Very frustrating.  I would really appreciate it if you guys could fix this with the next update!

I'm going to email you the false positive files in case nobody else did.

Title: Re: AVAST kills LogMeIn software
Post by: techserv on November 02, 2007, 03:02:27 AM
This is EXTREMELY irritating  >:(.  Almost all of my clients' computers run Avast and LogMeIn.  I have spent all afternoon setting up exclusions and will likely spend all day tomorrow and the next day patching my clients' computers.  And, of course since Avast is blocking LogMeIn on all of these computers, I get to do them all ON-SITE!!! Even if Alwil comes out with another update to fix this, the damage is already done since most of my customers delete files that are determined to be a virus which means I will have to re-install LogMeIn on those machines. This little issue is going to end up costing me a lot of money. 

I have been using Avast for a long time.  I can't believe they would be this irresponsible with their updates.  It's not like LogMeIn is a little un-heard of company.  They have been around a long time and have millions of users.

Time to start looking for another anti-virus solution...
Title: Re: AVAST kills LogMeIn software
Post by: jreins on November 02, 2007, 05:12:19 AM
This issue needs to be addressed ASAP. Two of my home PCs are dead, and a number of my family's PCs are having trouble as well since today's update. All have LogMeIn installed and all are being alerted for viruses. In one case, the PC crashes due to Avast trying to do something about a 'supposed' infection.

This is very sad. I got rid of other AVs due to false positives, but this one is much more crippling that others I have experienced. This needs to be corrected ASAP.
Title: Re: AVAST kills LogMeIn software
Post by: jreins on November 02, 2007, 05:19:51 AM
Can one of the Mods flag this as urgent, or whatever to get it addressed ASAP?!

This is a major issue that is going to cause widespread issues, as more than just home users use LogMeIn.

This false positive will be crippling within the next 24 hrs and needs to be resolved ASAP.
Title: Re: AVAST kills LogMeIn software
Post by: jreins on November 02, 2007, 05:59:06 AM
add the lm* files from the program directory to exclusions temporarilly and wait for the next VPS... we will fix that FP and add the files to our cleanset..

Maxx... without having to reinstall the app, can the 'damage' be reversed by the next vps update? I would imagine no, but I am hoping for the best!

If not, will we just have to have users move files from the chest back to their old loc?

Thanks!
Title: Re: AVAST kills LogMeIn software
Post by: aarbog2020 on November 02, 2007, 06:53:53 AM
We are having the same problems. Additionally, on some computers, the computer locks up when trying to log in via LogMeIn. Other computers are locking up upon bootup! Please fix ASAP.

Thanks,
Aaron
Title: Re: AVAST kills LogMeIn software
Post by: GerbilJammer on November 02, 2007, 08:29:41 AM
Odd thing is. I am using Log Me In free and have had no problems. If everyone could post which version of Log Me In they are using to help with the situation.
Title: Re: AVAST kills LogMeIn software
Post by: paulorox on November 02, 2007, 09:14:16 AM
I am using LogMeIn Free Version 3.0.606 and having the same problems reported here.
Title: Re: AVAST kills LogMeIn software
Post by: Maxx_original on November 02, 2007, 09:14:45 AM
jreins: you can recover the files from chest, if you've selected the action "move to chest"... anyway - if the FP occurs only with a commercial version or even one concrete build, then is hard for us to keep the cleanset fresh... that's nothing against our apologize for this annoying situation, sorry for that.. can you confirm, that the FP is now solved with the last VPS? btw: thanx for the files, we will add them to our cleanset.
Title: Re: AVAST kills LogMeIn software
Post by: paulorox on November 02, 2007, 09:39:54 AM
I have upgraded my LogMeIn Free client to version 4.0.667 and my Avast VPS version is 071102-0.

It now seems to be running fine.

Thanks for the quick update.
Title: Re: AVAST kills LogMeIn software
Post by: ikearcher on November 02, 2007, 01:10:52 PM
I had the same problem with LogMeIn & AVAST.  I added the files to the exclusion list but that made little difference when the PC is loading everything.  I received the warning box, and no matter what option I chose everything froze up & had to do a hard reset. 

I ended up just "Pausing" the Standard Shield and have not had any further problems.  I'm relying on Counterspy & process monitor for active protection.  I'm just going to leave Avast to watch email.

dan
Title: Re: AVAST kills LogMeIn software
Post by: oldman on November 02, 2007, 01:40:07 PM
I had the same problem with LogMeIn & AVAST.  I added the files to the exclusion list but that made little difference when the PC is loading everything.  I received the warning box, and no matter what option I chose everything froze up & had to do a hard reset. 

I ended up just "Pausing" the Standard Shield and have not had any further problems.  I'm relying on Counterspy & process monitor for active protection.  I'm just going to leave Avast to watch email.

dan

Did you add them to the on access exclusions list?

Left click the "a" icon, select standard shield, customize button, advanved tab.
Title: Re: AVAST kills LogMeIn software
Post by: Ximinez on November 02, 2007, 03:10:52 PM
We are having the same problems. Additionally, on some computers, the computer locks up when trying to log in via LogMeIn. Other computers are locking up upon bootup! Please fix ASAP.

Thanks,
Aaron

I saw this with my own PC last night (running LMI Free) when I was stuck at the "Connecting ... Please wait while a connection to My PC is established" screen for over 5 min and then couldn't break the failed connection from my PC once I got home because I had enabled remote screen blanking so I was forced to shutdown my computer by pressing-holding my power button for 8 sec.

When I tried rebooting the PC this morning, it locked up as well.  As expected, avast kicked in and flagged the two LMI*.dll files but I was able to tell avast to do nothing with them. I then disabled and re-enabled LMI and all is good again ... for now.

Virus database @ VPS 071102-0 ...

BTW, there is an active thread over at the LMI forum about this issue:

https://secure.logmein.com/forum/tm.aspx?m=11338 (you have to be logged in as a registered user to view it)
Title: Re: AVAST kills LogMeIn software
Post by: jreins on November 02, 2007, 04:18:50 PM
jreins: you can recover the files from chest, if you've selected the action "move to chest"... anyway - if the FP occurs only with a commercial version or even one concrete build, then is hard for us to keep the cleanset fresh... that's nothing against our apologize for this annoying situation, sorry for that.. can you confirm, that the FP is now solved with the last VPS? btw: thanx for the files, we will add them to our cleanset.

Maxx... thanks a bunch... you guys are doing great. The new release took care of everything. Best part is the LMI app was not affected as long as a connection attempt was not tried or if the PC was not rebooted...

In other words... no LMI connect or reboot, no problem! Some of the PCs I were concerned with are safe and didnt even notice the issue. Others can be addressed, but for the most part, this FP was nowhere near as damaging as it could have been for me and probably others, and even if it had been, it was nothing like I have experienced with other AV providers. Thanks again for the lightning fast response and attention to this issue.

Jason
Title: Re: AVAST kills LogMeIn software
Post by: captaine_kirk on November 02, 2007, 04:38:54 PM
Hi all, i have the same problem :

01/11/2007 19:10:25   SYSTEM   596   Sign of "Win32:Lmir-PG [Rtk]" has been found in "C:\WINDOWS\system32\LMIRfsClientNP.dll" file. 
01/11/2007 19:10:53   SYSTEM   596   Sign of "Win32:Agent-MVH [Rtk]" has been found in "C:\WINDOWS\system32\LMIport.dll" file. 
01/11/2007 19:12:18   admin   1884   Sign of "Win32:Vundo-gen53 [Adw]" has been found in "c:\windows\system32\lmiinit.dll" file.

I have sent an email to logmein customer support and this is their answer :

Hi,

As of 10/31/07, the latest version of Avast’s virus definitions has falsely identified some versions of the LogMeIn executables as being a virus.  This is not the case, and your computer has not been infected by any malware in relation to this warning.

Avast has been notified of this false-positive, and is working to correct the error.  Please disregard any messaging in Avast regarding LogMeIn until your next definition update.

More information on their issue can be found in there support forum's posting on this:
http://forum.avast.com/index.php?topic=31255.0

I hope this helps. Please let us know if you have any further questions.

Thank you,
Wendy Merrifield
LogMeIn Customer Support
Title: Re: AVAST kills LogMeIn software
Post by: RejZoR on November 02, 2007, 10:55:03 PM
I'm also using LogMeIn (Free) and i haven't encountered any problems with FP detection.
Title: Re: AVAST kills LogMeIn software
Post by: cpupro on November 02, 2007, 11:57:19 PM
I would like to add something to this thread. I too had this problem, I was alerted and did the necessary steps to detect and moved said files to the "virus chest". It was then suggested to do a "boot" virus scan which I did and it successfully found all files that were being called "ad-ware/key logger" or whatever the problem was. It moved the files to the chest that I agreed upon, finished and then booted up. :o

What I want to compliment on is that this is the first time, other than testing with "eicar" files, that I have seen how well this program works. It was great, it stepped you through all the processes and posted the information that you needed to know in a timely manner. It returned the system to login and went from there! :)

I want to thank you guys for making a great product! ;D This is fantastic that I got to see what a great amount of effort on your part is put into this application! ;D

Keep up the good work!! :)
Title: Re: AVAST kills LogMeIn software
Post by: Lisandro on November 03, 2007, 01:59:44 AM
Here, running Vista 32 bits, LogMeIn free, no problems with false positives.
Are you using the last virus database version?
Title: Re: AVAST kills LogMeIn software
Post by: cpupro on November 03, 2007, 02:12:34 AM
The computer that I had this on was XPSP2 with LogMeIn Free and IT. I had what I thought were the latest at that point but I didn't put the version down. I still have all the files in the "virus chest" and the program is operational. I didn't know if someone wanted to look at them so I kept them until such time.

I came home today and I checked everything that was reporting problems yesterday, it had updated and there were no further problems. :)
Title: Re: AVAST kills LogMeIn software
Post by: Lisandro on November 03, 2007, 02:18:21 AM
I still have all the files in the "virus chest" and the program is operational.
If you right click the files and scan them again, are they shown as infected?

I came home today and I checked everything that was reporting problems yesterday, it had updated and there were no further problems. :)
Glad they seem to be corrected the false positive...
Title: Re: AVAST kills LogMeIn software
Post by: cpupro on November 03, 2007, 02:27:29 AM
What I did today when I got home was do just that, I went and scanned the files that were giving me a problem and it didn't show as being infected. :)

It just updated again as I am writing this so I believe we are past the issues. :)
Title: Re: AVAST kills LogMeIn software
Post by: cpupro on November 03, 2007, 02:44:03 AM
One thing that I did want to say though is that when a virus is found and the option to send it to Avast is there, the file and a note, it doesn't go through MAPI at all, this is what happens everytime. Is this address still the correct one?

"Your message did not reach some or all of the intended recipients."

      Subject:   avast!
      Sent:   11/2/2007 6:38 PM

The following recipient(s) cannot be reached:

      'virus@avast.com'  on 11/2/2007 6:38 PM
            None of your e-mail accounts could send to this recipient.

Title: Re: AVAST kills LogMeIn software
Post by: Lisandro on November 03, 2007, 02:48:32 AM
Did you try SMTP?
You must set your SMTP settings (right click the 'a' blue icon > Program settings > STMP).
Title: Re: AVAST kills LogMeIn software
Post by: DavidR on November 03, 2007, 03:16:30 AM
One thing that I did want to say though is that when a virus is found and the option to send it to Avast is there, the file and a note, it doesn't go through MAPI at all, this is what happens everytime. Is this address still the correct one?

"Your message did not reach some or all of the intended recipients."

      Subject:   avast!
      Sent:   11/2/2007 6:38 PM

The following recipient(s) cannot be reached:

      'virus@avast.com'  on 11/2/2007 6:38 PM
            None of your e-mail accounts could send to this recipient.

That is weird as I can't send using SMTP only MAPI, but I never get any error like email accounts couldn't send to recipients.

I used to have similar errors not relating to sending to avast, but with a dial-up account if I tried to send an email where the account didn't match the ISP I had connected to, changing the From email address (email account) to match the ISP I was connected to resolved the problem.

The other aspect is if your email account requires authentication, that may cause the send to fail, but I'm not sure if this would give the same result. Check the SMTP settings match your default account in your email client.
Title: Re: AVAST kills LogMeIn software
Post by: cpupro on November 03, 2007, 03:18:00 AM
It sent that way, just wanted to see what was going on with doing it email. All the files currently in the "virus chest" have now been scanned and show "no virus".
Title: Re: AVAST kills LogMeIn software
Post by: Lisandro on November 03, 2007, 03:19:14 AM
All the files currently in the "virus chest" have now been scanned and show "no virus".
Another proof of the false positive nature of that alarm.