Author Topic: Reporting false positives  (Read 5219 times)

0 Members and 1 Guest are viewing this topic.

Offline Luftpost

  • Newbie
  • *
  • Posts: 2
Reporting false positives
« on: December 07, 2003, 03:35:59 PM »
Avast is an excellent product, but I find a few false positives ( verified by testing against Mcaffee, KAV, Antivir, AVast, Bitdefender, Etrust. Drweb. F prot). would you be interested in a copy of the file?

AVAST says it's Win95:SK , which is unlikely

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11722
    • AVAST Software
Re:Reporting false positives
« Reply #1 on: December 07, 2003, 03:41:44 PM »
What file is the virus reported in?

Offline Eddy

  • Avast Evangelist
  • Maybe Bot
  • ***
  • Posts: 31352
  • Watching (over?) you
    • Malware removal, Biljart and other things.
Re:Reporting false positives
« Reply #2 on: January 12, 2004, 12:32:09 PM »
I also have seen the false infection notification on several systems. It was always saying a file in the Windows(XP home/pro) temporary restore folder was infected. Scanning it says 'no infections found' I really think this is a bug in Avast

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67275
Re:Reporting false positives
« Reply #3 on: January 12, 2004, 01:19:34 PM »
I also have seen the false infection notification on several systems. It was always saying a file in the Windows(XP home/pro) temporary restore folder was infected. Scanning it says 'no infections found' I really think this is a bug in Avast

Sorry, I did not found any bug on avast! because of this... I scanned several XP systems (mine and friends). What were the avast error message? Did you configure the Reports options correctly (soft errors, ok files and so on)? Did avast! could 'reach' (access) the file for scanning?
The best things in life are free.

Offline Eddy

  • Avast Evangelist
  • Maybe Bot
  • ***
  • Posts: 31352
  • Watching (over?) you
    • Malware removal, Biljart and other things.
Re:Reporting false positives
« Reply #4 on: January 12, 2004, 01:23:34 PM »
Sofar It didn't occour on my system. On the customer systems I've seen it, I changed the log settings. Hope one come in soon so I can send the log files.

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67275
Re:Reporting false positives
« Reply #5 on: January 12, 2004, 01:33:59 PM »
Sofar It didn't occour on my system. On the customer systems I've seen it, I changed the log settings. Hope one come in soon so I can send the log files.

Please, do not mess 'log' with 'report' options... they're quite different  ;)
The best things in life are free.

Offline Eddy

  • Avast Evangelist
  • Maybe Bot
  • ***
  • Posts: 31352
  • Watching (over?) you
    • Malware removal, Biljart and other things.
Re:Reporting false positives
« Reply #6 on: January 12, 2004, 03:36:55 PM »
I found a system on which it happens. The report says this is the file infect: E:\System Volume Information\_restore{21897DF6-D972-4C77-B6D9-FD93BECE70D1}\RP35\A0001983.exe [L] Win32:P2P-Bereb-B [Wrm] (0)  It happend when XP wasn't used for a while and went back to the user login screen.

Offline Eddy

  • Avast Evangelist
  • Maybe Bot
  • ***
  • Posts: 31352
  • Watching (over?) you
    • Malware removal, Biljart and other things.
Re:Reporting false positives
« Reply #7 on: January 13, 2004, 08:40:27 PM »
Checked it on my own system, and yes, a virus warning when you do not use the comp for a while. And have the user login screen. Click on the name to get back to windows xp and there it is. Definatly a bug in Avast ::)

Offline Flintstone

  • Newbie
  • *
  • Posts: 3
Re:Reporting false positives
« Reply #8 on: January 13, 2004, 08:50:25 PM »
I had a similar false positive a few times :
C:\System Volume Information\_restore{5076FC79-9206-47D8-AC33-B64D44AFF77B}\RP53\A0010162.exe [L] Win32:Esednldr-B [Trj] (0)
Using WinXP Pro and avast 4 Home/Pro