avast av free alerts on its own uninstaller

[Tyreman]

Shows a detection threat on its own uninstaller
I always keep an uninstaller onboard  here
Also shows threat on long scan as well
I set it to do nothing
see below:

C:\Users\Downloads\aswclear5.exe [L] Win32:Malware-gen (0)
Infected files: 1
Total files: 69688
Total folders: 22157
Total size: 19.7 GB

*
* Scan stopped: Friday, February 04, 2011 5:38:20 AM
* Run-time was 2 minute(s), 14 second(s)
*

[Tyreman]

went to see what happens when I delete the Avast uninstaller
Avast alerts thats its a threat ya yada red box and to to chest

Tried to re download Avast uninstaller and it blocks the download but its Avasts Tool

Sorry to be candid BUT...Is this av software a ongoing beta 

[Coolmario88]

Avast! has 2 alerts for me. (see pics) EDIT: 2 pic removed for editing  2nd EDIT: Just Got done editing out my name in the picture.

[igor]

Will be fixed in the next virus definitions.

[Coolmario88]

Will be fixed in the next virus definitions.

OK, Did you guys get it i sent it through the virus chest i submitted it as a FP.

[dagrev]

Had the same thing this morning (my time).  Glad it will be addressed so quickly, but wonder what happened?

[sunsets]

I had:

C:\hp\KBD\KbdStub.exe

C:\users\name\Desktop\aswclear5.exe

D:\hp\Drv\APP22713\scr\KbdStub.exe

C:\hp\KBD\KbdStub.exe


What action should I take?

[DavidR]

Check out the KbdStub.exe file.

You could also check the offending/suspect file at: VirusTotal - Multi engine on-line virus scanner and report the findings here the URL in the Address bar of the VT results page. You can't do this with the file securely in the chest, you need to extract it to a temporary (not original) location first, see below.

Create a folder called Suspect in the C:\ drive. Now exclude that folder in the File System Shield, Expert Settings, Exclusions, Add, type (or copy and paste) C:\Suspect\*
That will stop the File System Shield scanning any file you put in that folder.

If only GData and avast detect it - GData uses avast as one of its two scanners so counts as 1 detection and almost certainly an FP.
Send the sample to avast as a False Positive:
Open the chest and right click on the file and select 'Submit to virus lab...' complete the form and submit, the file will be uploaded during the next update.

[sunsets]

Thank you David. I did a google search on KbdStub.exe. From what I've found, it's a file I need for my HP keyboard.

Should I click on Do Nothing for the threats that were found?

[DavidR]

Yes that would leave them in place, but it won't stop them being detected again is it isn't an Ignore and allow to Run command.

You have to submit to avast for then to analyse and correct the detection, but I would recommend following the complete process, VirusTotal, etc. as it gives them more evidence if only avast and gdata detect it.

[Nesivos]

Will be fixed in the next virus definitions.

I got two different threat alerts on this.

One when AIS did its daily afternoon scan and a second when I deleted the line item that the scan had placed in the Virus Chest.

see reply #6 on link

http://forum.avast.com/index.php?topic=70788.msg593181#msg593181

Thanks Avast team for taking care of this so quickly

Since removing the file I have on only one of the three computers that showed the threats run a Memory scan and a IE scan of the folder that had originally stored AWSClear5.exe file.  Both scans turned up clean.

[DavidR]

FP on aswClear5.exe resolved in VPS update 110204-1 (or -2), but the -2 one definitely no alert on scanning.

So it might be worth rescanning your other ones also.

[sunsets]

I updated my virus definitions. Everything has been fixed except for

D:\hp\Drv\APP22713\scr\KbdStub.exe

The above file is located in the D drive of my Factory Image on my HP computer. When I click on it, there is a Recovery subfolder. On the right hand side, it says

Recovery Partition
Warning!
 
This area of your hard drive
(or partition) contains files used
for your PC Recovery.
 
Do not delete or alter these files.
 
Any change to this partition could
prevent any recovery later.

[DavidR]

Have you send them the sample as I mentioned ?
If so just hold tight for now, they shouldn't be that long.

If not they need the sample and the false positive report so they are aware of the problem.

[sunsets]

No, I haven't.  Sorry, I don't know how to extract D:\hp\Drv\APP22713\scr\KbdStub.exe