Author Topic: ws2_32.dll and 081113-0 vps  (Read 8956 times)

0 Members and 1 Guest are viewing this topic.

sariza

  • Guest
ws2_32.dll and 081113-0 vps
« on: November 18, 2008, 04:52:00 PM »
Last week, we had a lot of problems, many computers reported infections on file: c:\windows\system32\ws2_32.dll with the virus "Win32:Trojan-gen {Other{ the computers reporting this were Windows XP SP2 with VPS 081113-0, but Windows XP SP3 and Vista with VPS 081113-0 were runing without problems, very few computers with Windows XP SP2 and VPS 081113-1 worked fine, after many hours investigating and a lot of computers with blue screen at logon, we decided to start in recovery console from a boot cd, and just copy the "infected" file with a SP3 version, it solved our problem. So I just want to know if some of you know about a problem with the VPS 081113-0 and the file ws2_32.dll

Best Regards
Sergio Ariza.

figarogdl

  • Guest
Re: ws2_32.dll and 081113-0 vps
« Reply #1 on: November 18, 2008, 06:48:49 PM »
well I just want to confirm the issue, same symptons, same solution...
I summited the file to a multiple antivirus engines online scanner and just avast! reported as suspiciuos.
I also summited the file to alwil to confirm that is a false positive, but they haven't answered until now.
As customer I expect an official answer and a way to prevent this kind of issues in the future.

Roberto Figueroa.

Offline DavidR

  • Avast √úberevangelist
  • Certainly Bot
  • *****
  • Posts: 86828
  • No support PMs thanks
Re: ws2_32.dll and 081113-0 vps
« Reply #2 on: November 18, 2008, 07:23:14 PM »
They are usually prompt to correct when an FP is sent and confirmed. Check scan the sample in the chest periodically after a VPS update, normally they only contact you if they require more information.

I don't know which multi-engine scanner you used, the virustotal one is probably the best one with 36 scanners it also uses the windows version of avast and other scanners.

VirusTotal - Multi engine on-line virus scanner and report the findings here the URL in the Address bar of the VT results page. You can't do this with the file securely in the chest, you need to extract it to a temporary (not original) location first.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 22.5.6015 (build 22.5.7263.730) UI 1.0.711/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

sariza

  • Guest
Re: ws2_32.dll and 081113-0 vps
« Reply #3 on: November 18, 2008, 09:10:57 PM »
I did the scan with virustotal, but virustotal had the vps 081113-1 with that vps Avast don't report an infection, the problem was with vps 081113-0, it was online some hours, but it cause in my case, many problems.

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67236
Re: ws2_32.dll and 081113-0 vps
« Reply #4 on: November 18, 2008, 11:05:57 PM »
I did the scan with virustotal, but virustotal had the vps 081113-1 with that vps Avast don't report an infection, the problem was with vps 081113-0, it was online some hours, but it cause in my case, many problems.
Sorry for the inconvenience... I see they tried to correct the error in the same day 11/13.
The best things in life are free.

figarogdl

  • Guest
Re: ws2_32.dll and 081113-0 vps
« Reply #5 on: November 19, 2008, 01:20:59 AM »
VirusTotal - Multi engine on-line virus scanner and report the findings here the URL in the Address bar of the VT results page

That's what I used, http://www.virustotal.com/analisis/ae58e46fa13b460f59879d0272709d75

I also used virscan: http://www.virscan.org/report/b8c9dfde976f85b9be842fbce4e74443.html




Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67236
Re: ws2_32.dll and 081113-0 vps
« Reply #6 on: November 19, 2008, 01:56:39 AM »
As far we can see, seems a false positive.
The best things in life are free.

sariza

  • Guest
Re: ws2_32.dll and 081113-0 vps
« Reply #7 on: November 19, 2008, 02:57:11 AM »
I did the scan with virustotal, but virustotal had the vps 081113-1 with that vps Avast don't report an infection, the problem was with vps 081113-0, it was online some hours, but it cause in my case, many problems.
Sorry for the inconvenience... I see they tried to correct the error in the same day 11/13.

Yes David that is true, and so good, only because the affected computers were unable to logon, and so, unable to update their VPS file, that was the real problem.

Roberto, that was good, you could get the report from virustotal and virscan.

Thanks everybody.
Best Regards.