Author Topic: FalsePositive? - Avast blocked Ragnarok Online 2  (Read 5911 times)

0 Members and 1 Guest are viewing this topic.

Offline gblu

  • Full Member
  • ***
  • Posts: 104
FalsePositive? - Avast blocked Ragnarok Online 2
« on: November 29, 2013, 04:51:21 PM »
i always get this warning when i try to launch ragnarok online 2 (indonesia server). it said, web shield blocked a harmful webpage or file. i can't play the game because avast blocked it.

infection: fileRepMetaGen (malware)
process : ragnarok online 2\shipping\dfcg\delphine.upd
url : h**p://dcfg.ragnarok2.lytogame.com/ragnarok21/201311/RO2_FIX.exe.1009


this always happens after i got new updates for the game (patch 20 november 2013). 
Intel E6300 Dualcore2 - 3GB RAM - GeForce 9400GT - WIN XP SP3 - AVAST! free - MBAM - Firefox  -  CCleaner

Toshiba NB520 - Win Seven Starter - AVAST! free

Offline Michael (alan1998)

  • Super Poster
  • ***
  • Posts: 2356
Re: FalsePositive? - Avast blocked Ragnarok Online 2
« Reply #1 on: November 29, 2013, 07:49:58 PM »
Hi,

If you can, please test the file @ www.virustotal.com.

Also, Please post that link about make SURE you keep the link INACTIVE to protect the users. Then I can ask polonus to do a detailed scan of that website and see what's up with it. If it turns out to be legit then in the next VPS update they will probably fix that...
Danny, best person in the School. Finally things are getting done.

Online polonus

  • Avast √úberevangelist
  • Maybe Bot
  • *****
  • Posts: 25018
  • malware fighter
Re: FalsePositive? - Avast blocked Ragnarok Online 2
« Reply #2 on: November 29, 2013, 11:08:08 PM »
This is an avast! File Rep alert. It probably means that those files did not come signed.
This is considered when flagging the File Rep Alert:

1. File Data changes (Emergence)
2. Number of computers, that executed that file (Prevalence)
3. Source URL
4. Status of the digital signatures

polonus
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline gblu

  • Full Member
  • ***
  • Posts: 104
Intel E6300 Dualcore2 - 3GB RAM - GeForce 9400GT - WIN XP SP3 - AVAST! free - MBAM - Firefox  -  CCleaner

Toshiba NB520 - Win Seven Starter - AVAST! free

Online Steven Winderlich

  • Massive Poster
  • ****
  • Posts: 2464
Re: FalsePositive? - Avast blocked Ragnarok Online 2
« Reply #4 on: November 30, 2013, 04:39:25 PM »
File looks clean (First submission 2013-08-04 20:14:09 UTC ( 3 months, 3 weeks ago )).

Please report it to Avast.

Send the file to virus@avast.com Subject: False positive.
Windows 10 Home 64-Bit, Intel Core i3 5010U 2.1 GHz, 4 GB DDR 3 RAM Single Channel, Intel HD Graphics 5500 (1 GB Video RAM) 1366x768 LED Display Non-Glare

Avast Premier 2015 R3 SP1, MCShield

Online polonus

  • Avast √úberevangelist
  • Maybe Bot
  • *****
  • Posts: 25018
  • malware fighter
Re: FalsePositive? - Avast blocked Ragnarok Online 2
« Reply #5 on: November 30, 2013, 06:19:38 PM »
This is one of the files analysed at Anubis: http://anubis.iseclab.org/?action=result&task_id=137f18d2ea0355a049d899edc4b3f19c7&format=html
I see no issues there,

polonus
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!