False Positive: Media Player Classic

[trparky]

hXXps://github.com/clsid2/mpc-hc/releases/download/2.3.5/MPC-HC.2.3.5.x64.exe

This download is being treated as a virus by Avast. Avast is the only antivirus engine out of several at VirusTotal that's detecting it as a virus.

My Event ID is 6cbaaae270f7/2024-09-04T23:47:38.739Z

[DavidR]

hXXps://github.com/clsid2/mpc-hc/releases/download/2.3.5/MPC-HC.2.3.5.x64.exe

This download is being treated as a virus by Avast. Avast is the only antivirus engine out of several at VirusTotal that's detecting it as a virus.

My Event ID is 6cbaaae270f7/2024-09-04T23:47:38.739Z

Please break active link to the suspect file, as I have in the quoted link.

Possible False Positive - New location to report both a False Positive and or a False Negative (for File or URL) - https://www.avast.com/submit-a-sample#pc

What is the VirusTotal link for the scan ?

[trparky]

https://www.virustotal.com/gui/file/04d4f8ae74c16f3f48cf09862339ccb915bbd8906d11b5f718abfb4ad3b21137

[DavidR]

That is good in that the file has been analysed as if it was simply the URL that you gave, in the VT tests the Web Shield scan on live sites can't be run.

So you could possibly override the Avast Alert Exception for the download location to download but not run the file. 
Now the File System Shield, should kick in and alert. It could be sent to quarantine and from there submitted to avast for analysis. 
Giving details on it and possibly this topic and or the virustotal results.

It may even be because the file isn't digitally signed given what I would consider a low grade alert FileRepMalware [Misc].

[polonus]

This is probably what is been alerted, the IP for that download address.
There is abuse on there. https://www.abuseipdb.com/check/140.82.112.4

polonus