Avast WEBforum
Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: Tyreman on February 04, 2011, 11:41:37 AM
-
Shows a detection threat on its own uninstaller ???
I always keep an uninstaller onboard here
Also shows threat on long scan as well
I set it to do nothing
see below:
C:\Users\Downloads\aswclear5.exe [L] Win32:Malware-gen (0)
Infected files: 1
Total files: 69688
Total folders: 22157
Total size: 19.7 GB
*
* Scan stopped: Friday, February 04, 2011 5:38:20 AM
* Run-time was 2 minute(s), 14 second(s)
*
-
went to see what happens when I delete the Avast uninstaller
Avast alerts thats its a threat ya yada red box and to to chest
Tried to re download Avast uninstaller and it blocks the download but its Avasts Tool
Sorry to be candid BUT...Is this av software a ongoing beta ???
-
Avast! has 2 alerts for me. (see pics) EDIT: 2 pic removed for editing 2nd EDIT: Just Got done editing out my name in the picture.
-
Will be fixed in the next virus definitions.
-
Will be fixed in the next virus definitions.
OK, Did you guys get it i sent it through the virus chest i submitted it as a FP.
-
Had the same thing this morning (my time). Glad it will be addressed so quickly, but wonder what happened?
-
I had:
C:\hp\KBD\KbdStub.exe
C:\users\name\Desktop\aswclear5.exe
D:\hp\Drv\APP22713\scr\KbdStub.exe
C:\hp\KBD\KbdStub.exe
What action should I take?
-
Check out the KbdStub.exe file.
You could also check the offending/suspect file at: VirusTotal - Multi engine on-line virus scanner (http://www.virustotal.com/) and report the findings here the URL in the Address bar of the VT results page. You can't do this with the file securely in the chest, you need to extract it to a temporary (not original) location first, see below.
Create a folder called Suspect in the C:\ drive. Now exclude that folder in the File System Shield, Expert Settings, Exclusions, Add, type (or copy and paste) C:\Suspect\*
That will stop the File System Shield scanning any file you put in that folder.
If only GData and avast detect it - GData uses avast as one of its two scanners so counts as 1 detection and almost certainly an FP.
Send the sample to avast as a False Positive:
Open the chest and right click on the file and select 'Submit to virus lab...' complete the form and submit, the file will be uploaded during the next update.
-
Thank you David. I did a google search on KbdStub.exe. From what I've found, it's a file I need for my HP keyboard.
Should I click on Do Nothing for the threats that were found?
-
Yes that would leave them in place, but it won't stop them being detected again is it isn't an Ignore and allow to Run command.
You have to submit to avast for then to analyse and correct the detection, but I would recommend following the complete process, VirusTotal, etc. as it gives them more evidence if only avast and gdata detect it.
-
Will be fixed in the next virus definitions.
I got two different threat alerts on this.
One when AIS did its daily afternoon scan and a second when I deleted the line item that the scan had placed in the Virus Chest.
see reply #6 on link
http://forum.avast.com/index.php?topic=70788.msg593181#msg593181 (http://forum.avast.com/index.php?topic=70788.msg593181#msg593181)
Thanks Avast team for taking care of this so quickly :)
Since removing the file I have on only one of the three computers that showed the threats run a Memory scan and a IE scan of the folder that had originally stored AWSClear5.exe file. Both scans turned up clean. :)
-
FP on aswClear5.exe resolved in VPS update 110204-1 (or -2), but the -2 one definitely no alert on scanning.
So it might be worth rescanning your other ones also.
-
I updated my virus definitions. Everything has been fixed except for
D:\hp\Drv\APP22713\scr\KbdStub.exe
The above file is located in the D drive of my Factory Image on my HP computer. When I click on it, there is a Recovery subfolder. On the right hand side, it says
Recovery Partition
Warning!
This area of your hard drive
(or partition) contains files used
for your PC Recovery.
Do not delete or alter these files.
Any change to this partition could
prevent any recovery later.
-
Have you send them the sample as I mentioned ?
If so just hold tight for now, they shouldn't be that long.
If not they need the sample and the false positive report so they are aware of the problem.
-
No, I haven't. Sorry, I don't know how to extract D:\hp\Drv\APP22713\scr\KbdStub.exe
-
You should be able to manually add this one to the chest, C:\hp\KBD\KbdStub.exe
Open the chest and right click in the Chest and select Add (see image), from the next window navigate to where you have the sample (C:\hp\KBD\KbdStub.exe) and add it to the chest. Once in the chest, right click on the file and select 'Submit to virus lab...' complete the form and submit as a possible False Positive, the file will be uploaded during the next update.
This only sends a copy to the chest, the original remains in place.
So it would now be possible to Extract a copy to the Suspect folder and upload to virustotal as I mentioned in my first reply.
-
Tried to re download Avast uninstaller and it blocks the download but its Avasts Tool
Sorry to be candid BUT...Is this av software a ongoing beta ???
not good to see things like that, or false alerts on HP utilities. not far ago avast rendered computers useless with a bad virus definitions update. makes you think what can happen next. not cool avast.