Marking File Safe

[Gadrin]

Is it possible in the home version to mark a file as "safe" ?

My last scan picked up this:

Code: [Select]

5/28/2008 10:55:19 AM Gadrin 3420 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\x\codex\Codex Arcanum Search.exe" file. 
Which isn't a Trojan, but an EXE I wrote and compiled myself.

Cheers !


>

[DavidR]

What did you use to write and compile ?
We seem to get a lot of this sort of stuff when using AutoIt as the script kiddies seem to use that.

Send the sample to virus@avast.com zipped and password protected with the password in email body, a link to this topic might help and false positive in the subject.

Or you can also add the file to the User Files (File, Add) section of the avast chest (if it isn't already there) where it can do no harm and send it from there (select the file, right click, email to Alwil Software). No need to zip and PW protect when the sample is sent from chest. A copy of the file/s will remain in the original location, so any further action you take can remove that.

If it is indeed a false positive, add it to the exclusions lists:
Standard Shield, Customize, Advanced, Add and
Program Settings, Exclusions
Restore it to its original location, periodically check it (scan it in the chest), there should still be a copy in the chest even though you restored it to the original location. When it is no longer detected then you can also remove it from the Standard Shield and Program Settings, exclusions.

[Gadrin]

I wrote it using Winbatch and their old and no longer supported HTML Dialog Extender. Which I think utilized MSIE.

However none of my newer Winbatch EXEs that automate MSIE via OLE get detected. All the large EXEs contain
DLLs that are copied to the folder if the DLL isn't found in the path. But like I said, their newer stuff doesn't
comeback as Virus/Trojan.

[DavidR]

Send it to avast for analysis as the Win32:Trojan-gen detection is done with what appears to be a generic (the -gen part) signature trying to catch multiple similar trojans with the one signature. Hopefully they can tweak it to avoid even the old version, otherwise you will have to exclude these files.

[misak]

It's false positive alert and will be fixed in next VPS update 080530-0