Problem with a shockwave game

[Moogle]

Ok, my friend sent me a message that avast was popping up with Dream Chronicles™ 2: The Eternal Maze from shockwave that it was a virus. I was like ok, she said shes played halfway though the game yesterday and today it gave her the virus pop up. I said Id try to download it and see if i got the same thing. Well it wont even let me download it. this is what i get when i try to download.

File Name: hxxp://downloadcdn.shockwave.com/pub/dreamchronicles2/InstallDreamChronicles2.exe

Malware name:Win32:Rbot-FTK [trj]

Malware type: Trojan Horse

VPS version: 080422-0, 04/22/2008

All it lets me do is abort the connection.

Dose avast think that it is a virus if my friend was able to download and play half way through yesterday? She uninstalled and reinstalled it now and gets the same error downloading.

Any Ideas?

[DavidR]

Seems to be the same issue as this post http://forum.avast.com/index.php?topic=34948.0, DrWeb link scanner doesn't find anything at that location so it may be a false positive.

Edit: Can you modify your link to the suspect file to avoid accidental exposure, e.g. hXXp://downloadcdn.shockwave.com/pub/dreamchronicles2/InstallDreamChronicles2.exe, we will still know where it comes from.

[Moogle]

So any way to get around it?

[Moogle]

Really is a pain, you can download and install the games if you stop avast, but that defeats the whole purpose of having avast then. If it was fine yesterday and now today, something was changed and it needs fixed.

[DavidR]

Well the problem is this file is I think 35MB plus so you can't upload it to something like virustotal which has a limit of 10MB, that is the usual way of confirming an FP.

In this case you either have to trust shockwave.com and the single scan by DrWeb finding it clean, pause the web shield to download, the standard shield will alert but you can choose ignore. But before you can run it to install the game you would have to exclude it from scans.

add it to the exclusions lists:
Standard Shield, Customize, Advanced, Add and
Program Settings, Exclusions

I have reported the link you gave as a possible false positive, so I would suggest you do the same. Send the above URL to virus@avast.com, a brief explanation of the problem, a link to this topic might help and false positive in the email subject.

[Moogle]

Well its not just that game its all of them on shockwave. Its a pain, but ill email them and let them know

[DavidR]

Give them the ones that you know about that may make them look deeper into the site to see why it is alerting.

[misak]

False positive alert Win32:Rbot-FTK [trj] has been fixed in last VPS update 080422-1