Author Topic: Avast & The Cleaner  (Read 4826 times)

0 Members and 1 Guest are viewing this topic.

Jonbvn

  • Guest
Avast & The Cleaner
« on: October 09, 2004, 03:08:10 AM »
I am running AVAST (pro) and The Cleaner professional (an AT program). My AV definitions have just updated to 0441-2.

Unfortunately, AVAST is now advising me that the cleaner monitor (a program to monitor changes to the registry) is infected with Win32.Prorat-I. I believe that this is a false positive. Now every time I boot I keep getting virus alerts.

Please advise how to overcome this problem. Note that uninstalling The Cleaner is not an option.

Jonbvn

techie101

  • Guest
Re:Avast & The Cleaner
« Reply #1 on: October 09, 2004, 03:33:11 AM »
Jon,

Firstly, I would recommend that you perform an online scan to determine if you ARE infected with the Win32 Prorat.

You can use TrendMicro or Kaspersky.

If and only IF, your system is clean by the online scan, can you assume that Avast is registering a false positive.

You then have the option of going into the Avast Virus Scanner/Exceptions and adding the pathway to the "false" positive.  Avast will bypass this file in all future scans.

Good luck.

Jonbvn

  • Guest
Re:Avast & The Cleaner
« Reply #2 on: October 09, 2004, 03:54:27 AM »
Did an online scan and I am completely clean.

I also scanned the suspicious files with multiple AV's at http://virusscan.jotti.dhs.org/
Again the files were listed as completely clean. Suprisingly, even AVAST listed

This is a definite FP, and I am setting my exceptions accordingly.

Jonbvn.

Jonbvn

  • Guest
Re:Avast & The Cleaner
« Reply #3 on: October 09, 2004, 04:25:00 AM »
Further to my previous post, it would seem that even when I set my exceptions, I still keep getting notification of FP's.

Time to find a better AV.....

GYL

  • Guest
Re:Avast & The Cleaner
« Reply #4 on: October 09, 2004, 09:07:39 AM »
Hi Jonbvn,i'll be difficult to find such a good AV,,wait a little somebody will explain you how to  repair this problem.This forum is wonderfull,.try to give the more informations as possible about your configuration ;wait that the PROS of this forum wake up

samygar

  • Guest
Re:Avast & The Cleaner
« Reply #5 on: October 09, 2004, 11:05:08 AM »
Hi,

I have the same pb with freecommander
www.freecommande.com.
The same virus Win32:Prorat-I [Trj] is reported on 2 different systems since the installation of the last virus definition update (0441-2).

But don't worry, this little pb won't change my AV choice.
My company use Norton AV. And I remenber than in the beginning of March, we were hardly attacked by Netsky.D and no NAV update was available during several hours.
Fortunatly Avast Virus cleaner was quicky updated and we can use it to deal with this threat.
Since this, I'm an Avast "ambassador" and I hope than in the futur this AV will have an place in my company.
 
I prefer a FP pb than a lack of reactivity.

Regards,
Sam.

PS: Sorry for my english (I'm french).

samygar

  • Guest
Re:Avast & The Cleaner
« Reply #6 on: October 09, 2004, 11:08:30 AM »
oops sorry for the bad links, the true is:
http://www.freecommander.com/index_en.htm

jannieuw

  • Guest
Re:Avast & The Cleaner
« Reply #7 on: October 09, 2004, 11:52:50 AM »
I also get a report from AVAST that "\THE CLEANER\moolive.exe" is infected
with "Win32:Prorat-I [Trj]"

Jan

Offline Eddy

  • Avast Evangelist
  • Maybe Bot
  • ***
  • Posts: 31080
  • Watching (over?) you
    • Malware removal, Biljart and other things.
Re:Avast & The Cleaner
« Reply #8 on: October 09, 2004, 11:58:02 AM »
This looks like false positive. Please send the files reported as infected in a password protected zip to virus@avast.com. Mention in the mail as what it is detected, that you think it is a false positive and the password ofcourse.

jannieuw

  • Guest
Re:Avast & The Cleaner
« Reply #9 on: October 09, 2004, 02:41:41 PM »
Send the file to virus@avast.com

Regards,
Jan

georgegerm

  • Guest
Re:Avast & The Cleaner
« Reply #10 on: October 10, 2004, 12:41:52 AM »
well this one got me also i got the same msg

THE CLEANER\moolive.exe" is infected
with "Win32:Prorat-I [Trj]"

i guess i panicked and erased it, it seems i was not the only one nice to know after getting more information

and funny enough i cannot get avast to do a complete scan or check c: without it rebooting the system