Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: Nick222 on September 27, 2008, 10:18:12 AM

Title: MW97:1TableBroken [Expl] strange false positive
Post by: Nick222 on September 27, 2008, 10:18:12 AM
Hello!

There is DOC file - 16 Mb.
Language of this file (name and content) is Russian.

When I move it from one directory to another - everything is OK.

But when I try to copy this file from one directory to another - Avast say "Sign of "MW97:1TableBroken [Expl]" has been found".

When I check this file directly by Avast - everything is OK :) .

What may be happened?!?

Avast 4.8.1229 Home Free, VDB 26.09.2008.
Windows XP Pro SP3 Russian.

How can I attach this file - in ZIP 4 Mb ?

Best regards :)
Title: Re: MW97:1TableBroken [Expl] strange false positive
Post by: RejZoR on September 27, 2008, 11:15:10 AM
Thats indeed funny. Lets wait for ALWIL guys to check in.
Title: Re: MW97:1TableBroken [Expl] strange false positive
Post by: igor on September 27, 2008, 11:17:40 AM
You can upload it to ftp://ftp.avast.com/incoming
One important question though: how exactly do you copy the file? Using Windows Explorer, or some other file manager?
Title: Re: MW97:1TableBroken [Expl] strange false positive
Post by: Nick222 on September 27, 2008, 11:30:12 AM
Copy, move and so on - by Total Commander 7.04a with option "Copy method - Big files".

FTP: file "Sample_False_positive.zip", password "virus".
Title: Re: MW97:1TableBroken [Expl] strange false positive
Post by: Lisandro on September 27, 2008, 02:53:34 PM
Like RejZor, I'm curious on this also...
Title: Re: MW97:1TableBroken [Expl] strange false positive
Post by: kubecj on September 30, 2008, 05:31:50 AM
This detection is very generic and triggers easily on broken word documents.
It seems that TC is copying in smaller chunks, avast scans them and finds broken file...

This detection looks like it needs some reworking...
Title: Re: MW97:1TableBroken [Expl] strange false positive
Post by: Nick222 on September 30, 2008, 07:41:57 AM
Same with uTorrent and partial downloads...
Title: Re: MW97:1TableBroken [Expl] strange false positive
Post by: Lisandro on September 30, 2008, 04:24:59 PM
This detection looks like it needs some reworking...
Wish you luck and good work... seems a time consuming activity...
Title: Re: MW97:1TableBroken [Expl] strange false positive
Post by: Nick222 on October 10, 2008, 12:53:13 PM
Work is very hard with this strange messages - I cannot copy many files...

How about updates of Avast?
Title: Re: MW97:1TableBroken [Expl] strange false positive
Post by: rxc on October 27, 2008, 04:08:06 PM
I am having the same problem, while copying a MS Word file in English from an external hard disk to an internal disk.  The original copy that put the file on the external hard disk did not report any problems, and the file was created and resided on a system that had a well-established security system (not Avast).

Title: Re: MW97:1TableBroken [Expl] strange false positive
Post by: waikikibeachsurfer on November 01, 2008, 01:49:19 PM
I have a similar problem. several weeks ago i wrote a big thesis paper for university, and now, as i wanted to print it to give it to my professor, avast tells me that this very file is infected with the MW97:1TableBroken [Expl]. when i don't get it, i am really f****ed up...  :'(

First of all, i moved the file to the container, but due to the fact that i really need it, i have to figure out how at least to print it so that i can transcribe it. I tried to open it with several programs (several ms-office-versions, wordpad and open office), tried to rename it (.rtf / .txt / .odt), but all that doesn't work out. Also i can't copy or move the file, when i don't let it rename by avast.

by the way: the first computer on which i tried to open the documetn is a new one, i installed avast some days ago. the word-document is on an extern harddisk, and of course i copied it on my old laptop (in the last three years also protected well by avast) to try to open it - without any results. i am completely aware that this is extremly dangerous, but i do have to open that file.

i can't imagine that the file is only broken, something else must have occurred...

Any clue what to do?
Title: Re: MW97:1TableBroken [Expl] strange false positive
Post by: DavidR on November 01, 2008, 04:10:16 PM
The only way you could access the file to say print it would be to pause the standard shield or add the file to the standard shields exclusions list. 

Whilst there is a risk involved, as has been mentioned this could be just a broken word document and not infected. However, to haul your ass out of the fire so to speak you may need to take this risk.

The safest option I would say would be to exclude the file rather than pause the standard shield, as if it were infected you wouldn't want it to be able to do anything with another file.

Add it to the exclusions lists:
Standard Shield, Customize, Advanced, Add and
Program Settings, Exclusions (right click the avast ' a ' icon)

Now you could print the file off and do a save file as and select .rtf or .txt format so you should be able to import the raw text into word again or keep it as an rtf file.
Title: Re: MW97:1TableBroken [Expl] strange false positive
Post by: Nick222 on March 18, 2009, 12:06:25 PM
And what about update?

Error not resolved...