Author Topic: False positive Win32:Evo-gen [Susp] - HUAWEI modem - hwdeviceservice.exe  (Read 3527 times)

0 Members and 1 Guest are viewing this topic.

Offline Titoos

  • Newbie
  • *
  • Posts: 4
Hello,

After today's Avast update (130729-0), I started receiving Win32:Evo-gen [Susp] rootkit message. I think it's a false positive, cause I had this installed since Sept. 2012.
Avast gave me two choices - to delete this file or move to quarantine. I deleted it, and then I scanned system on boot. Clean.

I'm wondering if anyone has had a similar situation?

Offline CraigB

  • Avast Überevangelist
  • Serious Graphoman
  • *****
  • Posts: 11143
  • No support PM's thanks
Do you use a USB internet dongle?

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37129
delete as first choise is not smart.... as now you have no file to upload to avast lab, or restore if needed

You can report a possible FP here: http://www.avast.com/contact-form.php
and you could also uploaded the file to avast lab from here

Clean, Quarantine, or Delete?
http://antivirus.about.com/b/2007/03/11/clean-quarantine-or-delete.htm

you can also upload files from avast quarantine (chest)
how to use chest.   http://www.avast.com/en-no/faq.php?article=AVKB21




« Last Edit: July 29, 2013, 08:57:27 PM by Pondus »

Offline Titoos

  • Newbie
  • *
  • Posts: 4
Do you use a USB internet dongle?

Yes. There weren't any problems in the morning. Then I turned off my comp, and turn on again around 5pm. Then, rootkit message appeared.


Offline CraigB

  • Avast Überevangelist
  • Serious Graphoman
  • *****
  • Posts: 11143
  • No support PM's thanks
Does the dongle still connect and the user interface open up correctly, if it was a false positive and you deleted it you may need to uninstall the dongles software from Program and Features and then reconnecting should ask to re-install it again.

If avast detects once again follow the links Pondus supplied to report false positives.

This is obviously only if your dongle is Huawei branded :-\
« Last Edit: July 29, 2013, 09:02:16 PM by craigb »

Offline Titoos

  • Newbie
  • *
  • Posts: 4
I uninstalled its software, reinstalled again. Avast detects it. But the dongle still connects, user interface opens up correctly.

I'll send this file.

Offline CraigB

  • Avast Überevangelist
  • Serious Graphoman
  • *****
  • Posts: 11143
  • No support PM's thanks
Yes send it as a false positive, you should be able to either tell avast to allow/ignore or exclude if necessary for the time being.

Offline Titoos

  • Newbie
  • *
  • Posts: 4
Hi,

Avast update (130729-1) solved the problem. I reinstalled modem software, everything went well, so it was a false positive.

Offline CraigB

  • Avast Überevangelist
  • Serious Graphoman
  • *****
  • Posts: 11143
  • No support PM's thanks
All good then :)