1click dvd copy false positive

[calcu007]

When it will fixed permanently? Each time that 1click is updated avast flagged it with w32.Vitro virus and I had to report it to Avast.

[Lisandro]

I can't say for sure... but Vitro is a very dangerous infection. Are you sure it's a false positive?
Can you send to www.virustotal.com and check?

[calcu007]

I can't say for sure... but Vitro is a very dangerous infection. Are you sure it's a false positive?
Can you send to www.virustotal.com and check?

Yes, only Avast and Gdata report a virus

[DavidR]

If only GData and avast detect it - GData uses avast as one of its two scanners so counts as 1 detection and almost certainly an FP.
Send the sample to avast as a False Positive:
Open the chest and right click on the file and select 'Submit to virus lab...' complete the form and submit, the file will be uploaded during the next update.

- In the meantime (if you accept the risk), add it to the exclusions lists:
File System Shield, Expert Settings, Exclusions, Add and
avast Settings, Exclusions

Restore it to its original location, periodically check it (scan it in the chest), there should still be a copy in the chest even though you restored it to the original location. When it is no longer detected then you can also remove it from the File System Shield and avast Settings, exclusions lists.

Your signature doesn't say what version of avast so I have assumed (not good) that you have 5.0.545 the latest avast version.

[Maxx_original]

it's because 1click is in each new instance packed with ACProtect/UltraProtect and the unpacked binary contains some "noise" that triggers this detection.. it is really difficult to fix such stuff permanently..

[Lisandro]

Thanks Maxx for throwing some light on what is happening. We appreciate the feedback.

[DavidR]

it's because 1click is in each new instance packed with ACProtect/UltraProtect and the unpacked binary contains some "noise" that triggers this detection.. it is really difficult to fix such stuff permanently..

Perhaps something to add to a checking list (to maintain the latest 1click version), not a white list as such as you wouldn't want to ignore it completely. Or if it is based on the packers, perhaps other checks if it comes up Vitro.

[Maxx_original]

Vitro generates false positives very rarely, but it can happen from time to time, mostly under some "strange" packers (ASProtect, ACProtect) as they modify the file to a similar form

[calcu007]

It is rara that it dont happen in their PRO version