Author Topic: Avast IS 11.1.2253 - More false positives: "Win64:Evo-gen [Susp]"  (Read 5122 times)

0 Members and 1 Guest are viewing this topic.

REDACTED

  • Guest
Using chocolatey and Avast is slowly becoming a pain in the buttocks since it has started to see "Win64:Evo-gen [Susp]" in perfectly harmless files.

No, I'm not secretly infected, no, the chocolatey repository has not been compromised. No, git and autohotkey have not suddenly turned evil.

This is getting rather frustrating, especially since I now have to constantly worry that avast is going to break another install via chocolatey after each "cup all".

Please, please fix your detection.


Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37585
  • Not a avast user
Re: Avast IS 11.1.2253 - More false positives: "Win64:Evo-gen [Susp]"
« Reply #1 on: March 28, 2016, 01:36:10 PM »
No it does not say infected  >  Win64:Evo-gen [Susp] = Suspicious

Quote
Please, please fix your detection.
How to report  >>  https://forum.avast.com/index.php?topic=14433.msg1289438#msg1289438


Offline Sirmer

  • Avast team
  • Sr. Member
  • *
  • Posts: 324
Re: Avast IS 11.1.2253 - More false positives: "Win64:Evo-gen [Susp]"
« Reply #3 on: March 29, 2016, 01:29:22 PM »
Hello,

can you please provide us these samples in password protected archive? I tried to search through our database and I was not able to find these files detected by our EVO-gens

REDACTED

  • Guest
Re: Avast IS 11.1.2253 - More false positives: "Win64:Evo-gen [Susp]"
« Reply #4 on: March 29, 2016, 02:14:43 PM »
No it does not say infected  >  Win64:Evo-gen [Susp] = Suspicious

Quote
Please, please fix your detection.
How to report  >>  https://forum.avast.com/index.php?topic=14433.msg1289438#msg1289438
That doesn't really matter much, given that the default settings for infected and "suspicious" files are 100% identical and the settings to change that are tucked away deep, deep inside a tab, inside a submenu, inside a separate settings menu behind a link inside the submenu of the main settings menu at the bottom of a locked filing cabinet stuck in a disused lavatory with a sign on the door saying beware of the leopard...

Nor does Avast communicate the fact that the "Virus" it lists as a "Virus" is only suspected as such beyond the short [Susp] in the name. So the fact that perfectly safe files are constantly quarantined by default is still quite a problem.

Hello,

can you please provide us these samples in password protected archive? I tried to search through our database and I was not able to find these files detected by our EVO-gens
I have already reported those files individually using the in-app submission feature. The false positives in git v2.7.3 have already been fixed as a result:

See https://forum.avast.com/index.php?topic=184357.0

I'm merely frustrated the the exact same false positive that broke my git-install now broke my autohotkey install less than ten days later. That sample has already been submitted as well.

If you want the files, you can easily download them all from here:

https://github.com/git-for-windows/git/releases/download/v2.7.3.windows.1/Git-2.7.3-64-bit.exe

and the current false positive here

https://autohotkey.com/download/ahk-install.exe

If perfectly harmless and very common open source projects keep tripping your detection every time there is a new version released, there may be something wrong with your detection.