Author Topic: Avast v5.0 mirc.exe problem  (Read 11339 times)

0 Members and 1 Guest are viewing this topic.

Defence

  • Guest
Avast v5.0 mirc.exe problem
« on: March 28, 2010, 06:54:54 PM »
When ı try run mirch.exe , avast say threat has been deteceted and potentially unwanted program block, why? I want to use mirch chat program, why avast block this program? How can ı solve this problem?

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89186
  • No support PMs thanks
Re: Avast v5.0 mirc.exe problem
« Reply #1 on: March 28, 2010, 07:22:26 PM »
Well your topic title mentions mirc.exe which is the correct file name for Microsoft Internet Relay & Chat, so what is this mirch.exe file ?

Perhaps avast believes it to be masquerading as mirc.exe ?

Or it is also related to some malware, see this, http://www.viruslist.com/en/news?id=48437 and http://www.2-spyware.com/remove-cosol-trojan.html.

What dies virustotal think of it ?
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.4.6112 (build 24.4.9067.762) UI 1.0.803/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Defence

  • Guest
Re: Avast v5.0 mirc.exe problem
« Reply #2 on: March 28, 2010, 07:26:51 PM »
I download this program here,

http://www.mirc.com/

When ı try run this program, avast block this mirc.exe file, why?

İnfection: win32:Mirc-Z [PUP]
« Last Edit: March 28, 2010, 07:40:43 PM by Defence »

Defence

  • Guest
Re: Avast v5.0 mirc.exe problem
« Reply #3 on: March 28, 2010, 07:52:07 PM »
From file system shield sensivity , When ı uncheck scan potentially unwanted programs, the problem solved.

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89186
  • No support PMs thanks
Re: Avast v5.0 mirc.exe problem
« Reply #4 on: March 28, 2010, 08:53:38 PM »
Well that doesn't appear to be what you are using as it is mirch.exe and not I would have expected, mirc.exe.

Of course if you don't scan for PUPs it won't be detected as that is what the [PUP] at the end of the detection is all about.

That is also the point about PUP detections, it is making you aware of a potentially unwanted program, now if you didn't install it then it could well have malicious intent, if you did install it and accept any risk, you can ignore the detection or go a step further by excluding it.

What about the suggestion to upload to virustotal and get an idea of what other scanners think ?
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.4.6112 (build 24.4.9067.762) UI 1.0.803/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline Dwarden

  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 1793
  • Ideas, that's ocean without borders!
    • Bohemia Interactive
Re: Avast v5.0 mirc.exe problem
« Reply #5 on: April 05, 2010, 08:29:29 PM »
i think this is huge oversight as mIRC is valid software ...
flagging it as PUP is equal to flagging Trillian or Skype as PUP ...

or any else reliable yet closed source shareware communication software....

in short absurd and false positive ...

also obviously using PUP with "ask first" fails to work ...
files always gets automoved to chest ...
« Last Edit: April 05, 2010, 08:40:25 PM by Dwarden »
https://twitter.com/FoltynD , Tech. Community, Online Services & Distribution manager of Bohemia Interactive

mhtsaras

  • Guest
Re: Avast v5.0 mirc.exe problem
« Reply #6 on: June 13, 2010, 12:42:05 AM »
I can confirm that the mirc problem is still present I just installed avast and I can not run, download, or install mirc if the real time shield is running.
Also guys the 5.0.545 with virus definitions 100612-1 (the latest ATM) are making my pc to slow down on performance, and games to stop responding, especially having avast scan all files.
Avast is very good antivirus but it needs to fix some things, like quicker response and better performance

marc-d-l

  • Guest
Re: Avast v5.0 mirc.exe problem
« Reply #7 on: June 13, 2010, 07:57:44 AM »
ThreatExpert's awareness of the file "mirc.exe":
   Across all ThreatExpert reports, the file "mirc.exe" was mostly identified as a threat.
File "mirc.exe" has the following statistics:
Total number of reports analysed   611,932
Number of cases that involved the file "mirc.exe"   102
Number of incidents when this file was found to be a threat   101
Statistical volume of cases when "mirc.exe" was a threat   99%
   
Notes:

    * Please note that the name of the file should NOT be used to define if it is legitimate or not. Such determination can only be made by observing its dynamic behaviour.
    * In order to check a file, please submit it to ThreatExpert.
    * For a comprehensive pro-active protection against threats, please consider ThreatFire - our behavioral antivirus solution.

The file "mirc.exe" is known to be created under the following filenames:
%ProgramFiles%\crazy script v.2\mirc.exe
%ProgramFiles%\hiperalem script v2\mirc.exe
%ProgramFiles%\kolaymirc\mirc.exe
%ProgramFiles%\marsivi\mirc.exe
%ProgramFiles%\mirc\mirc.exe
%ProgramFiles%\mircsitesi.com\mircsitesi.exe
%ProgramFiles%\mircsitesi\mircsitesi.exe
%ProgramFiles%\mircsitesi2008\mircsitesi.exe
%ProgramFiles%\msngr\messenger.exe
%ProgramFiles%\pattyscript\mirc.exe
%ProgramFiles%\sohbet\mirc.exe
%ProgramFiles%\sohbet24 script v.02\mirc.exe
%ProgramFiles%\zurnachat.com\mirc.exe
%System%\2448script\mirc.exe
%System%\blablabla.exe
%System%\caves.exe
%System%\coded.exe
%System%\darkbot\mirc.exe
%System%\ddj\mirc.exe
%System%\directx\postcard\explorer.exe
%System%\dllcache\r2c\mirc.exe
%System%\driver32\mirc.exe
%System%\drivers\svchost.exe
%System%\drivexp\mirc.exe
%System%\drona\mirc.exe
%System%\explorer.exe
%System%\inetsrv\daemon\mirc.exe
%System%\kappamirc\mirc.exe
%System%\karakirli.exe
%System%\kits.exe
%System%\mirc.exe
%System%\mirc\mirc.exe
%System%\mirc32.exe
%System%\moe\mirc.exe
%System%\newsfr.exe
%System%\operscript6.0b\mirc.exe
%System%\pusyy.exe
%System%\setup\drona\mirc.exe
%System%\setup\fsk.dll\mirc.exe
%System%\tunibot\mirc.exe
%System%\windirve\mirc.exe
%System%\wings.exe
%Temp%\copy of kaspersky\mirc.exe
%Temp%\ekaix\mirc.exe
%Temp%\hackerze_v2h\mirc.exe
%Temp%\ixp000.tmp\mirc.exe
%Temp%\mirc\mirc.exe
%Temp%\mirc-6.31-ita_tuttoirc\mirc-6.31-ita_tuttoirc\mirc.exe
%Temp%\noob wizard\mirc.exe
%Temp%\oblivion\mirc.exe
%Temp%\pinoy pride v.2\mirc.exe
%Temp%\spoolsv.exe
%Windir%\driver cache\i386\spoolsv.exe
%Windir%\help\winhlp.exe
%Windir%\mirc.exe
%Windir%\mixer.exe
%Windir%\pif\lsass.exe
%Windir%\system\kits.exe
%Windir%\system\svchost.exe
%Windir%\system\system\svchost.exe
%Windir%\temp\spool\spoolsv.exe
%Windir%\temp\spoolsv\spoolsv.exe
%Windir%\temp\spoolsv\svchost.exe
%Windir%\temp\tmp0000729b\daemon.exe
%Windir%\wincra\mirc.exe
%Windir%\winend\mirc.exe
c:\ftou_mirc\mirc.exe
c:\ircap\crack\crack.exe
c:\ircap\mirc.exe
c:\kacak4\mirc.exe
c:\mirc script\mirc script irc op v2.1\mirc.exe
c:\mirc.exe
c:\mirc\mirc.exe
c:\mircturk\mircturk.exe
c:\mtscs.exe
c:\recycler\s-1-5-21-606747145-1085031214-725345543-500\mirc.exe
c:\sevbi\mirc.exe
c:\seviyo\mirc.exe
c:\sevsen\mirc.exe
c:\sharmscript\mirc.exe
c:\sysreset\mirc.exe
c:\wsohbet\mirc.exe
Notes:

    * %ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.
    * %System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
    * %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
    * %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.


The file "mirc.exe" has the following possible country of origin:
Origin   Number of Incidents
   United Kingdom   13

mhtsaras

  • Guest
Re: Avast v5.0 mirc.exe problem
« Reply #8 on: June 13, 2010, 11:13:59 AM »
I agree that many times, viruses and or trojans can disguise or poison some exe files and many times those exe files are under some big brand names like micro$oft etc.
I haven't seen an antivirus programm to block a micro$oft's exe and making windows stop running but many times this happens with small brands / apps, like the good old mirc.
Yoy know what I mean... 
« Last Edit: June 13, 2010, 11:16:04 AM by mhtsaras »