Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: avuser on October 11, 2009, 02:37:01 AM

Title: A false positive of AVAST!!! 11/10/2009
Post by: avuser on October 11, 2009, 02:37:01 AM

I'm an avast user in China,here i'd like to say it's a good Antivirus software,but SogouPY.ime is a text input software!Not Virus！I upload the pics ! I hope this mistake could be repaired quickly! I'm waiting!!

Title: Re: A false positive of AVAST!!! 11/10/2009
Post by: DavidR on October 11, 2009, 02:48:00 AM

You could also check the offending/suspect file at: VirusTotal - Multi engine on-line virus scanner (http://www.virustotal.com/) and report the findings here the URL in the Address bar of the VT results page. You can't do this with the file securely in the chest, you need to extract it to a temporary (not original) location first, see below.

Create a folder called Suspect in the C:\ drive, e.g. C:\Suspect. Now exclude that folder in the Standard Shield, Customize, Advanced, Add, type (or copy and paste) C:\Suspect\* That will stop the standard shield scanning any file you put in that folder. You should now be able to export any file in the chest to this folder and upload it to VirusTotal without avast alerting.

If it is indeed a false positive, see http://forum.avast.com/index.php?topic=34950.msg293451#msg293451 (http://forum.avast.com/index.php?topic=34950.msg293451#msg293451), how to report it to avast! and what to do to exclude them until the problem is corrected.

####
There is a report as a false positive link at the bottom right of the alert window also.

Title: Re: A false positive of AVAST!!! 11/10/2009
Post by: avuser on October 11, 2009, 03:36:26 AM

thank you for your reply~I've already copy this Method and Release it on the Official website of SOGOU BBS .there are many avast users Complaining the  false positive ！I THINK THIS WILL HELP THEM TOO!

Title: Re: A false positive of AVAST!!! 11/10/2009
Post by: refraction on October 11, 2009, 06:13:30 AM

this is the result of SogouPY.ime form VIRUSTOTAL
http://www.virustotal.com/analisis/58d2f53a7b73edcba2729ffc29c3363e3d7f945b0a3d70513a948e0b7cffc236-1255234163

Title: Re: A false positive of AVAST!!! 11/10/2009
Post by: Tarq57 on October 11, 2009, 06:39:35 AM

Looks like it's already been fixed. (No Avast detection in that VT result.)

Title: Re: A false positive of AVAST!!! 11/10/2009
Post by: DavidR on October 11, 2009, 04:11:50 PM

Not necessarily, as on occasion the VirusTotal VPS version is older than that of the user. Though in this case it seems they have the latest VPS (current version 091010-0), since their last updated is shown as 2009.10.11.

I do however, notice they don't have the latest program version.

So we will have to see if it really has been corrected, when avuser re-scans the file.