Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: kirba on January 15, 2010, 10:19:40 PM

Title: False report on sroking launcher.exe?
Post by: kirba on January 15, 2010, 10:19:40 PM

Since today afternoon i experience problem with avast reporting malware-ger on launcher.exe file from SROking bot.

Page where you can find this file is www.sroking.com

P.S
i submitted file to analysis as false positive

Title: Re: False report on sroking launcher.exe?
Post by: Pondus on January 15, 2010, 10:28:04 PM

upload the file to www.virustotal.com when you have the result copy the URL in the adressbar and post it here


Norton Safe Web
http://safeweb.norton.com/report/show?url=http%3A%2F%2Fwww.sroking.com%2F&.x=9&.y=11

Title: Re: False report on sroking launcher.exe?
Post by: kirba on January 15, 2010, 11:55:36 PM

http://www.virustotal.com/analisis/055d541f270280d779b7368e96fb6135934e3bd2a07fd4d6e4874fbed912a03d-1263596030

Title: Re: False report on sroking launcher.exe?
Post by: DavidR on January 16, 2010, 01:07:24 AM

Looks like some others find it suspicious, whilst a number of those detections are generic or heuristic and more prone to mis-detection, it is still suspect.

In your first post you reported avast alerting on launcher.exe, yet you uploaded the complete SROKing2.0.15_1_4_.exe file, since that is a self extracting archive, that may also stop some scanners from unpacking the archive to scan the contents. This could artifically reduce the number of detections.

So if you can extract the launcher.exe and upload that on its own and see if there is any difference.

Title: Re: False report on sroking launcher.exe?
Post by: kirba on January 16, 2010, 07:54:16 AM

Here are results for launcher.exe alone

http://www.virustotal.com/analisis/6f1b8a05eb87830ce33595c29d891181d92cb58343409674bb8292c7523ddbbf-1263624728

Title: Re: False report on sroking launcher.exe?
Post by: DavidR on January 16, 2010, 04:41:38 PM

OK, that is marginally better with only 6/41 detections. Many of those also being generic or heuristic which are more prone to mis-detection, strangely on this file alone avast doesn't alert in the VT results.

The last avast update on virustotal's details is today, so confirm that you have VPS version: 100116-0 and rescan the launcher.exe file and see if it is detected.

Title: Re: False report on sroking launcher.exe?
Post by: kirba on January 16, 2010, 07:40:05 PM

I have that last update.

And here is the result after i re uploaded it.

http://www.virustotal.com/analisis/6f1b8a05eb87830ce33595c29d891181d92cb58343409674bb8292c7523ddbbf-1263667006

Title: Re: False report on sroking launcher.exe?
Post by: DavidR on January 16, 2010, 08:34:51 PM

I meant for you to scan the file on your system to see if it is detected there as it wasn't detected on VT last time out (and one less this time round).

We are in effect unconcerned with what other scanners detect, but if avast (on your system) still detects it.

Title: Re: False report on sroking launcher.exe?
Post by: kirba on January 16, 2010, 09:55:28 PM

I run a scan and there is no virus report now. Great  :)

Title: Re: False report on sroking launcher.exe?
Post by: DavidR on January 16, 2010, 10:59:09 PM

OK, thanks for the feedback.