Avast 4.8 just found Win32:Malware-gen in RootRepeal.exe

[Jack 1000]

Could 4.8 have picked up a false posititve based on the OP's issues that 5.0 fixed on its own?

Jack

[DavidR]

1. Yes it has been acknowledged as an FP which has been corrected internally and will be released on a VPS Update.

I still can't get Anubis to make sense of the exes though. It says:

"Unfortunately your file could not be executed. Either your file is not a valid Windows executable or some of its startup-dependencies have not been met."

2. you shouldn't have uploaded a .zip file to anubis, just the .exe file that was detected.
It is looking at the zip file in its entirety as a single file. It doesn't extract or scan the contents it isn't designed for that, it analyses a single file you upload, that is why it is saying it isn't a valid windows executable.

[sparge]

David,

We seem to have a communication issue here. I would characterize it as you over-inferring. Maybe it's just you answering hurriedly.

'Do not tell me about these files in the future,'

1) If you want to paraphrase what I said, Quote is not the right tool. Quote means exactly that - what was said, not what someone else inferred or paraphrased from it. Misusing Quote like that makes it a meaningless feature of discourse. It's not even a good paraphrase. I just asked if it was a FP.

2) Even when do you Quote, it seems you don't Read. I said:

"I still can't get Anubis to make sense of the exes though"

and you said I shouldn't have uploaded a zip file?!? I uploaded an exe file. That's why I called it an exe. And Anubis said what it said about the exe that I uploaded. About both of them actually; the originally-installed one, and the one that mysteriously appeared in C:\windows\temp. So my question remains a valid one. Why can't Anubis make sense of these exes? Might, for example, Avast! have subtly changed something in the process of putting them into the chest and taking them out again?

Andy

[DavidR]

1. edited my post, looks like my copy and paste of what I wanted didn't take and ended up with my previous copy.

2. forgive me for being busy and wasting your time trying to help you, I know how to reduce that load.