Author Topic: False positive from CurseClient.exe  (Read 3554 times)

0 Members and 1 Guest are viewing this topic.

RazorLan

  • Guest
False positive from CurseClient.exe
« on: February 26, 2011, 06:29:49 PM »
I have a program that I have been running on my computer for quite some time, CurseClient.exe (v4), from www.curse.com.  It is a program that assists users in keeping addons for the game "World of Warcraft" up to date. I run Avast on a Windows XP service pack 3 system, along with Spybot Search and Destroy, using the built-in Windows firewall.  This morning when I tried to run CurseClient, Avast detected it as a Win32:Dropper-gen virus and automatically moved it to quarantine.  I then updated Avast to the latest free version via the update button in the Avast program.  I still got the same results.  I added CurseClient to the list of exclusions and turned off the Sandbox, and then uninstalled and reinstalled CurseClient.  I am still getting the same results.  Is there anything else I can do to fix this so I can run CurseClient again?  I have never had this problem before today, and I have been running both programs together successfully for quite some time prior to this.

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67183
Re: False positive from CurseClient.exe
« Reply #1 on: February 26, 2011, 06:34:56 PM »
Can you inform the file as being a false positive? (click on the bottom right of the virus warning message).

To know if a file is a false positive, please submit it to VirusTotal and let us know the result. VirusTotal has a file size limit of 10Mb. You can use VirScan also.
If it is indeed a false positive, send it in a password protected zip to virus@avast.com. Please, mention in the body of the message why you think it is a false positive and the password used. Thanks.

Maybe you need to disable Hide protected operating system files and enable View hidden files and folders to manage the file(s).

As a workaround, you can add these files to the Files Shield exclusion list.
Left click the 'a' orange icon, click on the Real-Time Shields folder at left > File Shield > Expert Settings > Exclusions > Add.
You can use wildcards like * and ?. But be careful, you should 'exclude' that many files that let your system in danger.

You can also add it to the general exclusion list (on demand scannings). Left click the 'a' orange icon, click on Settings button > Exclusions > Add.
The best things in life are free.

RazorLan

  • Guest
Re: False positive from CurseClient.exe
« Reply #2 on: February 27, 2011, 08:10:07 AM »
I went to www.curse.com, and by reading the forums there, discovered that there are other users who have both curseclient.exe and Avast who are experiencing an identical issue just since the last virus definitions update.  Some of them listed steps in those forums which allowed me to add curseclient.exe to the list of exeptions correctly, so that I can run the program again.  I already submitted the file as a false positive by clicking the link on the virus warning message I got from Avast.  I scanned the file in question with VirusTotal, as suggested here, and it gave the results of 0/43 when it was finished.  I take it that the next step would be to send the file in a zipped, password protected format, to the above listed email address?
« Last Edit: February 27, 2011, 08:42:42 AM by RazorLan »

RazorLan

  • Guest
Re: False positive from CurseClient.exe
« Reply #3 on: March 01, 2011, 03:01:22 PM »
My virus definitions updated this morning.  In order to check on this issue, I removed the exclusions I had added and ran CurseClient.  Sandbox started up, asked me if I wanted to run this program in it, and I told it "NO."  CurseClient then started up as normal, with no virus warnings.  So, whatever was causing the problem appears to be fixed.