Avast WEBforum

Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: iwannet on October 02, 2004, 06:46:14 PM

Title: Avast 4.1 Pro? Bug or False Detection? Win32:Trojano-351
Post by: iwannet on October 02, 2004, 06:46:14 PM
I found a little funny link. A forum link  ;)
Please use OPERA 7.5 as your browser, with Avast 4.1 Pro and VPS Sept 28, 2004 Engine 0440-0...

Try this link

http://www.m3-access.com/community/forum/topic.asp?ARCHIVE=&TOPIC_ID=3961 (http://www.m3-access.com/community/forum/topic.asp?ARCHIVE=&TOPIC_ID=3961)

And you will found virus detected Win32:Trojano-351 [Trj]  
I think this forum had some "unique" words that same with Virus ID?
I dont know?  ??? Is this bug? or Avasst scan with heuristic?

But this Virus can't found if we're using IE, Mozilla or FireFox Browser  ;D


OOT:

BEst Regards,...


4926
Title: Re:Avast 4.1 Pro? Bug or False Detection? Win32:Trojano-351
Post by: Eddy on October 02, 2004, 06:58:16 PM
Would would someone use a old vps? 440-3 is the most recent.
Title: Re:Avast 4.1 Pro? Bug or False Detection? Win32:Trojano-351
Post by: iwannet on October 02, 2004, 07:14:33 PM
I am using VPS 440-3 now..
THe problem still occurs.. Found Virus..  ???

But, its okay.. No problem, i can accept those "funny" problem.
And AVAST is still The best for me  8)

Thanks
Title: Re:Avast 4.1 Pro? Bug or False Detection? Win32:Trojano-351
Post by: DavidR on October 02, 2004, 08:41:39 PM
If you are getting a virus warning that you believe is a false positive, then if you can zip and password protect ('virus', will do) the suspect file and send it to virus @ avast.com (no spaces).

Give a brief outline of the problem, the fact that you believe it to be a false positive and include the password in the body of the email. Some info on the avast version and VPS number (see about avast {right click avast icon}) will also help.

You could also check the offending/suspect file at: Jotti - Multi engine on-line virus scanner www.virusscan.jotti.dhs.org (http://www.virusscan.jotti.dhs.org) if any other scanners here detect them it is less likely to be a false positive.

HTH David
Title: Re:Avast 4.1 Pro? Bug or False Detection? Win32:Trojano-351
Post by: softwareguy on October 03, 2004, 08:10:58 PM
No virus is detected on that page here. :-\
Title: Re:Avast 4.1 Pro? Bug or False Detection? Win32:Trojano-351
Post by: Lisandro on October 03, 2004, 08:56:45 PM
Avast scan with heuristic?

Only Mail scanning has heuristics, not the other providers.

But this Virus can't found if we're using IE, Mozilla or FireFox Browser  ;D

Strange, won't the problem be on Opera?
Title: Re:Avast 4.1 Pro? Bug or False Detection? Win32:Trojano-351
Post by: iwannet on October 06, 2004, 05:09:09 PM
Sorry guys.. Now seem okay. Not detected anymore..  (cunfusing)

But i am still keep the file (i took from opera cache), that moved by Avast to Virus Chest Directory. And i dont know how to read the html code

Here you can download the html file http://www.kesetrum.com/free/opr052EL.htm (http://www.kesetrum.com/free/opr052EL.htm) ..

Notes: Use "save as" target..

Thanks for your kind help...
Title: Re:Avast 4.1 Pro? Bug or False Detection? Win32:Trojano-351
Post by: S.Z.Craftec on November 05, 2004, 01:39:25 PM
Same thing is happening in here, but only when I try to open this thread  ???  ???  ???

See here:

http://forum.avast.com/index.php?board=2;action=display;threadid=8402 (http://forum.avast.com/index.php?board=2;action=display;threadid=8402)
Title: Re:Avast 4.1 Pro? Bug or False Detection? Win32:Trojano-351
Post by: matthew on November 05, 2004, 02:28:31 PM
I say holy shit!

Quote
No, I don't think something is wrong with that thread, but there is some suspicious link in very first post in that thread...

On the other hand, take a look how strange is that thread's form... everything is shifted to far right without any visible reason... no huge attached pictures, nothing...

and

Quote
Just passed through the same thread. I'm right now using NOD32 until avast! 4.5 final is out (if i'll be able to wait that long  ) and i didn't get anything (settings are maxed out). But i'm using firefox...

????!!!!?!?!??!?

i just can't find something not offensive to reply. but i didn't come to offend anybody, so i just say goodbye.
Title: Re:Avast 4.1 Pro? Bug or False Detection? Win32:Trojano-351
Post by: RejZoR on November 05, 2004, 02:48:07 PM
Whats the problem if i'm using NOD32 right now? I'm testing antiviruses on regular basis (not only throwing samples at them, but actually using them so i can recommend them based on all aspects,not just detection) so thats nothing unussual.
My main antivirus is still avast! which is installed and in use most of the time. I just pointed that NOD32 doesn't find anything as for doublecheck...
Title: Re:Avast 4.1 Pro? Bug or False Detection? Win32:Trojano-351
Post by: Eddy on November 05, 2004, 02:57:51 PM
I just had a look at the source code of the page iwannet posted.

That page redirects to http://public.searchbar****.com. That is one of the pages responsible for spreading the Blazefind adware. So it is perfectly understandable why Avast would react on it. (I ofcourse have put the *'s there, to avoid people from going there)
Title: Re:Avast 4.1 Pro? Bug or False Detection? Win32:Trojano-351
Post by: Lisandro on November 05, 2004, 03:02:53 PM
Matthew, your place won't be on avast forums this way...
If you do not realise where you are and what kind of forums are these, it's better take a breath and do not login  8)

I take the freedom to publish an IM he sent to me because it was infected by Win32:Trojano-351. Can Alwil team help me on this? Thanks.

(Today at 02:06:15pm) matthew has sent you the following Instant Message:
I researched the issue a little cuz it happened to me too (btw, latest
program and definitions). The problem is not with opera. i don't even think it's a false positive. The warning is triggered by the string "********************", part of ""  (the long hex string can differ from case to case). I just downloaded the script from there (using wget.exe) and, for what i can tell, i didn't like at all. actually looks like some kind of trojan or spyware to me. i attached it with my post.


I DON'T HAVE TIME TO GET RID FROM THIS.
I'M ANGRY TO RECEIVE INFECTED FILES (OR FALSE POSITIVES).
THIS IS MY COMPUTER AND I DON'T WANT IT INFECTED JUST FOR FUN
 >:(
Title: Re:Avast 4.1 Pro? Bug or False Detection? Win32:Trojano-351
Post by: Lisandro on November 05, 2004, 03:15:14 PM
I just had a look at the source code of the page iwannet posted.

That page redirects to http://public.searchbar****.com. That is one of the pages responsible for spreading the Blazefind adware. So it is perfectly understandable why Avast would react on it. (I ofcourse have put the *'s there, to avoid people from going there)

Thanks Eddy.
Sometimes I want to send this kind of people to hell  :P
Title: Re:Avast 4.1 Pro? Bug or False Detection? Win32:Trojano-351
Post by: Eddy on November 05, 2004, 03:26:02 PM
According to Jotti, Avast is theonly one who detects that IM as infected. So it sure looks like a FP.
Title: Re:Avast 4.1 Pro? Bug or False Detection? Win32:Trojano-351
Post by: Lisandro on November 05, 2004, 07:17:46 PM
According to Jotti, Avast is theonly one who detects that IM as infected. So it sure looks like a FP.

It's a matter of him...  :(
Why don't the users do like any other and send the file to virus@avast.com ?
Why should it take our time just to mess your connection, avast, email and so on.
I lose too much time with this guy. I'm really upset. It's not frequent, but today  >:(
Title: Re:Avast 4.1 Pro? Bug or False Detection? Win32:Trojano-351
Post by: S.Z.Craftec on November 06, 2004, 12:33:36 AM
Yes Technical is completely right. Who gives him right to send that file, infected or not, doesn't matter, to someone's personal address ? He should ask first if he doesn't know what should he do... or simple send it to virus@avast.com as technical mentioned above...

And, his language... well, I remember some people got  censured because of even smaller curses...

Bottom line, what did he find offensive in my post ? Did I say anything against him ? See here:

http://forum.avast.com/index.php?board=2;action=display;threadid=8402 (http://forum.avast.com/index.php?board=2;action=display;threadid=8402)

If someone find even his name somewhere among the lines, I'll apologize, otherwise I expect apology from him >:(
I didn't even bother to see whose post is that one which made those trojan problems...

I am here to help to others if I can, as always... that means, if I see something that is alarming, my duty is to alarm my friends, avast! users and forum members - which I did, right on time.

matthew - if you have problems with that, just try to ignore my posts in the future... ok ?
Title: Re:Avast 4.1 Pro? Bug or False Detection? Win32:Trojano-351
Post by: Lisandro on November 06, 2004, 12:48:22 AM
I am here to help to others if I can, as always... that means, if I see something that is alarming, my duty is to alarm my friends, avast! users and forum members - which I did, right on time.

Thanks for sending the alarm... I think it was another thing, an infected email, start 'fighting' against it... lose time... and Alwil confirms it's not a false alarm  >:(
Title: Re:Avast 4.1 Pro? Bug or False Detection? Win32:Trojano-351
Post by: Negeltu on November 06, 2004, 04:13:39 AM
Well, I don't care much for the guys posts... but I remember some members getting away with the same "foul" language...and they are posting in this thread.  They got away with it multiple times just because they are a long time member.  :)
Title: Re:Avast 4.1 Pro? Bug or False Detection? Win32:Trojano-351
Post by: S.Z.Craftec on November 06, 2004, 12:52:51 PM
Well, the difference is, those members are warned once and never again repeated that "foul" language.

Learn on other's mistakes... or even on your own.

I still don't believe eny of members that posted in this thread is an Angel.. When I say any, I mean it... let's not pretend to much...  ;)

No one ever "got away" like you said... no excuses of course... want me to show you PMs from moderators ? Well, that's not gonna be necessary. They know what I'm talking about...

And by the way, you are long time member as well... although not so many posts. Of course that doesn't matter, because I know that you helped so many times. That's what counts... but... but, you never said any single word to me before, that tells me you don't like me so much. I don't care... it's not my problem, I can not make everyone likes me... I keep going, like always...

Cheers happy people !
Title: Re:Avast 4.1 Pro? Bug or False Detection? Win32:Trojano-351
Post by: lee16 on November 06, 2004, 01:03:30 PM
Quote
I still don't believe eny of members that posted in this thread is an Angel.. When I say any, I mean it... let's not pretend to much..

i agree

--lee
Title: Re:Avast 4.1 Pro? Bug or False Detection? Win32:Trojano-351
Post by: Eddy on November 06, 2004, 01:05:07 PM
Let it rest peoples. This has nothing to do with the topic and doesn't belong in this forum and if you ask me even not on this board.
Title: Re:Avast 4.1 Pro? Bug or False Detection? Win32:Trojano-351
Post by: S.Z.Craftec on November 06, 2004, 01:27:23 PM
Yeah Eddy is right, so let it go... I'm sure we will see so many threads like this one in the future (unfortunately).

The truth is, no one is Angel, everybody curses, there is no excuses, but we really should watch our language used in here, 'cause I'm sure there is so many young members reading posts in these forums.

I made mistakes as many others, I admit it (although I used abbreviations), but after moderator warned me, I will not repeat my mistake twice.

Let's stay best forum ever...
Title: Re:Avast 4.1 Pro? Bug or False Detection? Win32:Trojano-351
Post by: iwannet on November 06, 2004, 02:54:35 PM
I just had a look at the source code of the page iwannet posted.

That page redirects to http://public.searchbar****.com. That is one of the pages responsible for spreading the Blazefind adware. So it is perfectly understandable why Avast would react on it. (I ofcourse have put the *'s there, to avoid people from going there)

You're right. I use "adMuncher" for banner blocker. And every html loaded, they change some code from banner/ads. So, the browser doesnt show those banner.

But, i am sure the problem on STRING that came from the forum i've posted before..  I shutdown "AdMuncher" temporary  clearing cookies, temporary, cache. And reload that link. And the problem still occurs. But, i dont know (still confusing)? The problem didnt happen again right now ::)

Now,  I am using Outpost Firewall, for banner blocke. Not AdMuncher anymore  ;)