Author Topic: eMailaya - urgent  (Read 7093 times)

0 Members and 1 Guest are viewing this topic.

emailaya

  • Guest
eMailaya - urgent
« on: October 04, 2008, 09:54:18 PM »
HI
users of emailaya reported me that avast suddenly started reporting emailaya (im the developer) as a virus and doesnt let them use the application. since this is a very important application for them, this issue is very urgent.

as mentioned, im the developer so for sure this is a false positive.
what can be done about it so it will be fixed as soon as possible?
thanks

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67194
Re: eMailaya - urgent
« Reply #1 on: October 04, 2008, 09:59:10 PM »
Can you send it in a password protected zip to virus@avast.com. Please, mention in the body of the message why you think it is a false positive and the password used. Thanks.

As a workaround, you can add these files to the Standard Shield provider (on-access scanning) exclusion list.
Left click the 'a' blue icon, click on the provider icon at left and then Customize. Go to Advanced tab and click on Add button...
You can use wildcards like * and ?. But be careful, you should 'exclude' that many files that let your system in danger.
The best things in life are free.

emailaya

  • Guest
Re: eMailaya - urgent
« Reply #2 on: October 04, 2008, 10:11:15 PM »
hi and thank you for a quick response
i sent it as you described.
please update me as soon as possible.
thanks

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67194
Re: eMailaya - urgent
« Reply #3 on: October 04, 2008, 10:36:58 PM »
hi and thank you for a quick response
i sent it as you described.
please update me as soon as possible.
thanks
I'm an user like you. They usually inform by updating (correcting) the virus database. They only contact when they need further information.
The best things in life are free.

emailaya

  • Guest
Re: eMailaya - urgent
« Reply #4 on: October 04, 2008, 10:52:02 PM »
mmm so i guess i should tell the user to try and err then until there is no warning
thanks

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67194
Re: eMailaya - urgent
« Reply #5 on: October 04, 2008, 10:58:59 PM »
mmm so i guess i should tell the user to try and err then until there is no warning
thanks

The easier will be adding the file into Chest (quarantine) and then check from there, right clicking the file. Adding a file is not moving it, you can add files right clicking the user folder into Chest.
The best things in life are free.

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89230
  • No support PMs thanks
Re: eMailaya - urgent
« Reply #6 on: October 05, 2008, 01:41:38 AM »
users of emailaya reported me that avast suddenly started reporting emailaya (im the developer) as a virus and doesnt let them use the application. since this is a very important application for them, this issue is very urgent.
<snip>

What file is actually being detected and what is the malware name given by avast ?

The reason I ask is I downloaded the emailya.zip I extracted and scanned the emailya.exe file but nothing was found, but I don't believe it was able to fully unpack it.

Ah I see that is a standalone exe, so when I run it I still don't get an alert, I scanned the Data folder it creates and still no detections.

So perhaps the problem is in the installation file version ?

OK I did a basic setup with one email account and sent an email checked for inbound email (having sent a test email to that account), this was received and again no alerts by avast, avast is successfully scanning outbound and inbound email traffic through eMailYa, so I don't know what the problem is. This is with the latest version of emailya 3.5.5 I believe.

So we really need to know more about what is being detected.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.4.6112 (build 24.4.9067.762) UI 1.0.803/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

emailaya

  • Guest
Re: eMailaya - urgent
« Reply #7 on: October 05, 2008, 08:27:31 AM »
hi

i will try to contact the 2 users who reported me about this issue
but until then here is what one of them wrote me: http://emailaya.phpbb3now.com/viewtopic.php?f=6&t=54

emailaya

  • Guest
Re: eMailaya - urgent
« Reply #8 on: October 05, 2008, 02:18:29 PM »
both users confirmed that the file on site (which u tested) is ok.
one of them still has an exe file which was detected as a virus. i asked him to send it to you and i hope he will. please update me about this issue, though now, it is not as urgent as before.

thanks

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89230
  • No support PMs thanks
Re: eMailaya - urgent
« Reply #9 on: October 05, 2008, 02:42:01 PM »
You're welcome, thanks for the update, it seems like the user reporting this has found the same as I did, the latest version isn't seen as a problem.

Your comment about UPX exe packer possibly being the issue I would say is possibly very close as this is commonly used in malware packing. Also the malware name given by avast, Win32:Trojan-gen(other) is a generic signature.

The avast Win32:Trojan-gen is generic signature (the -gen at the end of the malware name), so that is trying to catch multiple variants of the same type of malware and is a fine balance between detecting a new variant and detecting something valid as infected.

So that could have been a contributing factor when combined with the UPX packer. It would be nice if the original person reporting this sent you or avast a copy of the suspect file it would be very helpful.

It would have also been great if he had come directly to the avast forum and submitted the sample to avast directly as in Tech's reply to you which is likely to have speeded any correction as required.

Unfortunately I won't be able to update you on progress as I'm only an avast user.
« Last Edit: October 05, 2008, 02:43:35 PM by DavidR »
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.4.6112 (build 24.4.9067.762) UI 1.0.803/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

emailaya

  • Guest
Re: eMailaya - urgent
« Reply #10 on: October 05, 2008, 02:54:55 PM »
weird thing is both files were upxed so i wonder why avast detects a virus on one exe but not on the other.

2 other antiviruses (avg and nod32) also detected a virus in emailaya 2-3 weeks ago and only because as a developer i had the chance to check it un-upxed i realized this might be it. they fixed it 2-3 weeks ago so i guess now its avast turn to fix it :)

the end user ofcourse doesnt care whether it's a generic detection or a real one, he wants his files to be clean and ofcourse i agree with that. i find it a bit dangerous that an antivirus suddenly decides a certain file is a virus and doesnt let u activate the app no matter how important it is to him, some people will email me about it but some users might simply delete the file and i wont even know about it. avast does have a whitelist but avg/nod32 didnt open the file even when it was in exclusion list.

i told the guy who has the infected exe to send it to the address written here for a checkup, i hope he will do it. so u r a user too :) i guess avast people are too busy to let me know what i sent them is ok and that i should send them the real problematic exe... good thing they have good people like u and tech to help people like me regarding this issue.

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89230
  • No support PMs thanks
Re: eMailaya - urgent
« Reply #11 on: October 05, 2008, 03:46:46 PM »
The detection generic or otherwise is considered real by the user it isn't the method but the response.

The user has the option to exclude the file form scans (their choice, their risk) both on-access so they can run it and from on-demand scans if they use that function.

They can add it to the exclusions lists:
Standard Shield, Customize, Advanced, Add and
Program Settings, Exclusions (right click the avast ' a ' icon)

Restore it to its original location, periodically check it (scan it in the chest), there should still be a copy in the chest even though you restored it to the original location. When it is no longer detected then you can also remove it from the Standard Shield and Program Settings, exclusions.

This is why I mentioned the first port of call really should have been this forum as this can be pointed out to them whilst any corrective action is taken.

We would first have suggested that they confirm or deny the detection by uploading the file to VirusTotal - Multi engine on-line virus scanner and report the findings here.

You normally don't get a response to the submissions unless they require more information, which is why I suggest to users they periodically scan the suspect file, which unfortunately if you aren't using avast you wouldn't be able to do.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.4.6112 (build 24.4.9067.762) UI 1.0.803/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

emailaya

  • Guest
Re: eMailaya - urgent
« Reply #12 on: October 05, 2008, 04:15:31 PM »
to users who know me i can say to exclude the file but i prefer not to do so and simply "fix" it with the AV developers but what about the (new) users who doesnt know me? for them, emailaya is a virus and that's it. i even saw 2 posts on forums (which are not mine) that warns the users from it, if i didnt search google and got to those posts (by mistake) i wouldnt be able to "warn" back that this is a false positive.
 
when emailaya was detected by avg and nod32 as a virus i did upload the file to VS:
http://www.virustotal.com/it/analisis/65bec64743fa3ae1dfb2c69024829dcf
the results there are a bit old (in antiviruses life, even 2-3 days can be considered as old) so i dont know the current way of things. notice that avast is clean there....

at least now things are not as urgent as i first thought.

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67194
Re: eMailaya - urgent
« Reply #13 on: October 05, 2008, 10:22:38 PM »
what about the (new) users who doesnt know me?
It's an annoyance... nobody likes false positives... but, sometimes, the price of a high detection rate or detection method.

in antiviruses life, even 2-3 days can be considered as old) so i dont know the current way of things. notice that avast is clean there....
The quality of the VirusTotal service is not as good as it should... the updates are not reliable.
The best things in life are free.