Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: Steele on March 11, 2004, 04:03:25 AM

Title: TONS OF NEW ALARMS
Post by: Steele on March 11, 2004, 04:03:25 AM
Why am I getting all of these virus alarms today!??  >:(

They were never here before! After a new update and a manual scan today...I get all these viruses?? I just scanned my system yesterday.

Half of them are from when I visted ebay?

There are still MORE viruses after todays update? These files have been on my PC before...weeks and weeks before and avast has never detected anything? I suspect there is something wrong and I don't think ANY of these files are in fact infected.  :P

What's going on??  ???

Steele
Title: Re:TONS OF NEW ALARMS
Post by: Steele on March 11, 2004, 04:47:44 AM
Wow! Here are some more!

I think these are false positives.... how could they ALL appear out of the blue? I think todays update of the defininition file has caused perhaps a few false positives?

Does Avast4Home HATE ebay???  ???lol  ;D

I'll send these files into Avast.
Title: Re:TONS OF NEW ALARMS
Post by: JEfromCanada on March 11, 2004, 05:32:50 AM
I think these are false positives.... how could they ALL appear out of the blue? I think todays update of the defininition file has caused perhaps a few false positives?

I'm pretty sure you're right about the false positives.  This is the first time avast has EVER signalled a problem on my machine.  And it was with a two-year old file!
Title: Re:TONS OF NEW ALARMS
Post by: gardenwife on March 11, 2004, 06:14:49 AM
Same thing here. I'm a brand-spankin'-new user, though, so I didn't know what to think. Glad I'm not the only one.
Title: Re:TONS OF NEW ALARMS
Post by: SKYCOMP on March 11, 2004, 07:53:36 AM
Hello Gardenwife, hopefully someone will be along to address your concerns. I wouldn't lose any sleep over Malware, if in fact they turn out to be a problem. Its a simple solution to either pass them over or give them the boot. Adaware does an excellent job at cleaning up those bugs & is a very nice partner in tantum with Avast! And don't be too alarmed if your words go unheeded for awhile. Avast! found 2 trojan files supposedly on my machine recently, probably leftovers from an earlier owner of this box. I posted my concern & was met with a suggestion to Look Them Up on the Boardsearch that returned nothing defining these 2 Finds. So i just boxed them up in a seperate Folder for my own research. Case closed. Its comforting that Avast! can pick out even the leftovers from a malicious program.
Title: Re:TONS OF NEW ALARMS
Post by: gardenwife on March 11, 2004, 08:01:25 AM
Hi, Skycomp - Thanks for the reply. I just deleted the three eBay HTML files from my temp directory since they wouldn't have any bearing on other stuff.

I also noticed it put 3 system files in the chest, but when I scanned them, it said they were fine. They'd just been copied into the chest, evidently, because when I tried to restore them, it asked if I wanted to copy over the destination files. I told it no.
Title: Re:TONS OF NEW ALARMS
Post by: Lisandro on March 11, 2004, 12:47:32 PM
False positives!

Please, avast! team see this 403-6 VPS file!  :(
Title: Re:TONS OF NEW ALARMS
Post by: Pavel Baudis on March 11, 2004, 01:48:50 PM
False positives!

Please, avast! team see this 403-6 VPS file!  :(

We are working on it right now - another set of Trojan-gens has been added last night. While most of the alarms are real one, there are two false alarms. We will remove them and release the update today (together with the FP reported from you)..

Pavel
Title: Re:TONS OF NEW ALARMS
Post by: RejZoR on March 11, 2004, 02:26:09 PM
Its easy to test for false positives. Disable avast! Resident Shield,extract FP suspected file and check it with at least two other antivirus programs/online services to confirm suspicion. If both other give positive result than its not FP. Simple.
Title: Re:TONS OF NEW ALARMS
Post by: Lisandro on March 11, 2004, 02:44:19 PM
Its easy to test for false positives. Disable avast! Resident Shield,extract FP suspected file and check it with at least two other antivirus programs/online services to confirm suspicion. If both other give positive result than its not FP. Simple.

RejZor, I copied the files in a floppy and test them against AVG, Norton and TrendMicro on-line...
I'm sure that my Auto-It files (posted in the virus board) are false positives... I cannot work with my computer untill I have a new VPS  :'(
Title: Re:TONS OF NEW ALARMS
Post by: RejZoR on March 11, 2004, 02:59:00 PM
Well Technical,its a bit different in your case,because you are 100% sure that those files are virus free (because you made them) :D
Title: Re:TONS OF NEW ALARMS
Post by: JEfromCanada on March 11, 2004, 04:04:25 PM
Well Technical,its a bit different in your case,because you are 100% sure that those files are virus free (because you made them) :D

I think that when files that have been on your PC for a long time (whether you authored them yourself or not) all of a sudden turn up as positive for viruses/trojans, that can mean only one of two things.  The most likely is a false positive reading.  But the second, I suppose, is a newly discovered (by whitehats) vulnerability that's been in the field for a very long time.

That second scenario is not as likely, but I guess possible.  An example of this might be the technical flaw discovered in the unix compression algorithm.  If you had created a program using one of the flawed libraries, then a new version of a virus scanner might flag your program as compromised - even if you had been using the same, unmodified component for years.

I also suppose that some benign feature in an application which PREVIOUSLY was not dangerous could become dangerous if an update was made to the underlying operating system that facilitated the ability of an older program to cause havoc.

Too much to consider.  I just want my feeling of security back!  :)
Title: Re:TONS OF NEW ALARMS
Post by: spiketoo on March 11, 2004, 05:47:11 PM
I believe I also am getting false positives on files over a year old. I am still getting them with VPS 0403-7.
Title: Re:TONS OF NEW ALARMS
Post by: LAB on March 11, 2004, 06:00:48 PM
Because we are on the topic of false positives and since I have never received any warnings of a suspicious file, I wanted to ask if a file is moved to the virus chest and later found out that it is not a virus, how do you restore the file to its original location?
Title: Re:TONS OF NEW ALARMS
Post by: spiketoo on March 11, 2004, 06:02:41 PM
Because we are on the topic of false positives and since I have never received any warnings of a suspicious file, I wanted to ask if a file is moved to the virus chest and later found out that it is not a virus, how do you restore the file to its original location?

Thats a real good question becuase I moved two files to the 'moved' folder and now I cannot even copy them to send to Avast, nor move them anywhere.
Title: Re:TONS OF NEW ALARMS
Post by: Pavel Baudis on March 11, 2004, 06:11:17 PM
I believe I also am getting false positives on files over a year old. I am still getting them with VPS 0403-7.

Did you send them to virus@avast.com ? This is the only way we can see them and if they are really false positives, the detection will be corrected ASAP.

Pavel
Title: Re:TONS OF NEW ALARMS
Post by: Lisandro on March 11, 2004, 06:48:49 PM
Pavel, I'll turn on my computer and try to update...
Sorry for the impatience... Thanks for the corrections  8)
Title: Re:TONS OF NEW ALARMS
Post by: spiketoo on March 11, 2004, 06:52:27 PM
Well, first I couldn't even copy the files from the 'moved' folder - access was denied (logged on as Admin). Then, via avast scan, I moved the files from the 'moved' folder to 'chest'. However, these files would not display via the Chest Viewer. 8 files were present in the chest (via Explorer), but index.xml only showed entries for the 6 system files.

I used the word 'were' in the chest because I was getting an avast error when I attempted to start the antivirus pgm - could not complete the memory test - something about cannot load system somethingorother - I'm sorry, I tried to screen print the error but I couldn't. So I just reinstalled the entire program.

I've been impressed by the sophistication and ease of use of this program, however I now have grave concerns based on the incidents of today.
Title: Re:TONS OF NEW ALARMS
Post by: Lisandro on March 11, 2004, 07:02:55 PM
spiketoo, if you have troubles with the Chest, probably because a non-succesfull installation, the behavior of the software won't be that one which is planned for... If you reinstall the program right now you will be able to post any further problem and we will try to help you (if we can).  :-\
Title: Re:TONS OF NEW ALARMS
Post by: Steele on March 11, 2004, 07:11:31 PM
Wow  :o

So it turns out I'm not alone here with the possible false positives??  ???

At any rate.... I moved ALL of those files to the chest then I extracted them to be put into a .ZIP file and sent them to the Avast team to analyze.

Like I said, those files have been in my temp folder since Christmas and I have NEVER ONCE picked up a virus from my temp folder....especialy all the ones from EBAY!  :-[

Hope this is fixed soon!
I did my part by contributing and sending the files to avast  ;D

Kindest regards,

~ Steele Wolf ~
Title: Re:TONS OF NEW ALARMS
Post by: Steele on March 11, 2004, 08:22:29 PM
VPS 0403-7 has fixed yesterdays problem for me.

VPS 0403-6 generated all those false positives in my screen-shot, but I re-scanned those files today with the new VPS and they all pass!  ;D

I still however see that this latest VPS is still casuing problems.  :-\

Technical, I can only imagine how frustrating this must be for you as you use Auto-It, and no longer can use your PC for this task. Pretty weird stuff how every file you MAKE comes out as a virus! A false one of course...but still.  :'(

I'm sure your problem will be cleared up very soon.
The question is: Will it be today? And will it be in the NEXT VPS version?  :-\

I hope so!
It is very possible for two VPS releases in one day.
It's happened before?  :)

Best of luck Technical,
~ Steele Wolf ~
Title: Re:TONS OF NEW ALARMS
Post by: Lisandro on March 11, 2004, 08:50:10 PM
Technical, I can only imagine how frustrating this must be for you as you use Auto-It, and no longer can use your PC for this task. Pretty weird stuff how every file you MAKE comes out as a virus! A false one of course...but still.  :'(
I'm sure your problem will be cleared up very soon.
The question is: Will it be today? And will it be in the NEXT VPS version?  :-\
I hope so!

Thanks, VPS 0403-7 has fixed all problems with AutoIt compiled scripts.
I'm on my XP system again  :)

It is very possible for two VPS releases in one day.
It's happened before?  :)

Yes, this already happened before. But today, at least for me, it was not necessary, just one new VPS was enough. Thanks avast team  :-*
Title: Re:TONS OF NEW ALARMS
Post by: SKYCOMP on March 11, 2004, 11:53:45 PM
False positives!

Please, avast! team see this 403-6 VPS file!  :(

We are working on it right now - another set of Trojan-gens has been added last night. While most of the alarms are real one, there are two false alarms. We will remove them and release the update today (together with the FP reported from you)..

Pavel

That should be sufficient in this case, however can you explain what a Trojano-025 is, taken from the Avast! alert system? It is still not clearly defined or perhaps you can provide the resource base that can further explain this "virus alert".
Title: Re:TONS OF NEW ALARMS
Post by: SKYCOMP on March 12, 2004, 03:10:48 AM
False positives!

Please, avast! team see this 403-6 VPS file!  :(

We are working on it right now - another set of Trojan-gens has been added last night. While most of the alarms are real one, there are two false alarms. We will remove them and release the update today (together with the FP reported from you)..

Pavel

Good job Pavel, keep in mind as long as we have the cooperation from the many,you will always be able to correct the few. (FP's) Please continue to do the best you can, pretty soon the FP reviews i've read as a downside will have to eat their words.
Title: Re:TONS OF NEW ALARMS
Post by: tapsu on March 12, 2004, 12:12:31 PM
I too had new viruses found every time I scanned my email files... but it were the same files over and over again, even though Avast was suposedly removed them? In the end, I removed the (empty) folders where the viruses had originally been, and now it's OK.
 ???