dslreports logo
site
 
    All Forums Hot Topics Gallery
spc

spacer




how-to block ads


Search Topic:
uniqs
132547
share rss forum feed


onDvine
Don't Litter. Spay-Neuter.
Premium
join:2005-01-29
So. CA, USA
kudos:9
Reviews:
·Verizon Online DSL

3 recommendations

False positive in Avast! or is it real?

Click for full size
Found the notice (above, top) that a Trojan had been detected and I chose "Move to chest." The computer was on w/ only the screen saver running and browser windows closed.

Also found 3 entries in Avast's Warning Log that seem related but none of the applications are likely to be involved with a Trojan.
--
The secret of happiness is to admire without desiring. Carl Sandburg


Cudni
La Merma - Vigilado
Premium,MVM
join:2003-12-20
Someshire
kudos:13

1 recommendation

judging purely by the name then it is FP. report it to Avast

Cudni



Pentangle
With our thoughts we make the world.
Premium
join:2006-06-01
Vancouver BC
kudos:2
reply to onDvine

Avast just updated itself and within two minutes began reporting many instances of Win32:Delf-MZG. If I hadn't stopped the scan it would have moved numerous files to the chest. Something is very wrong here!


rhdcheme

join:2006-11-18
Lorton, VA
reply to onDvine

I agree. Something is not right. it is detecting a lot of false trojans (including Dell program and SpyBot).



Stem Bolt
Aka Smiling Bob
Premium
join:2002-11-08
Cleveland, OH
kudos:2

1 edit
reply to onDvine

Avast is also giving a false alarm on "Online Armor" files.
--
Kaspersky + Online Armor + Router/SPI



Grimm43
You Never Hear The One That Kills You
Premium
join:2000-11-02
Largo, FL
reply to onDvine

I can't even get through the memory scan without Avast flagging three entries I know are PF.

Never had this problem before.



Pentangle
With our thoughts we make the world.
Premium
join:2006-06-01
Vancouver BC
kudos:2

1 recommendation

I've posted an inquiry on Avast Forum. What a royal pita!! My wifes computer has been hit with numerous warnings as well.



Avast User

@sky.com
reply to onDvine

Glad I found this.

Avast has just started doing the same on mine, thought spybot had been infected so deleted it.


AARGH

join:2003-03-26
Sterling, VA
reply to onDvine

Just had Avast claim that Speedfan and AnyDVD had exact same Malware.

Anyone else getting this....

Last time this happened it took awhile before Avast owned up.



onDvine
Don't Litter. Spay-Neuter.
Premium
join:2005-01-29
So. CA, USA
kudos:9
reply to onDvine

Well...I see I'm not alone in this.



Mirihika

@clear.net.nz
reply to onDvine

Yes, I've just had reports of the same Trojan from the same Avast update infecting Yaldex Javascript, PC Tools Spyware Doctor and a couple of System Restore files. Since I have very good Kerio firewall protection I'm sceptical too.



Helpnafriend

@charter.com
reply to onDvine

My friend was using FL Studio and Avast randomly reported a ton of viruses,
and as he was scanning his comp it Identified the infection as Win32:Delf-MZG.
How should he deal with this?


maxwedge2

join:2001-10-18
N5P-3L6
reply to AARGH

Yes, same thing happening here
just updated Virus definitions and its telling me I have a bunch of infections, I already trashed 1 app by moving a file to chest, went to chest and restored it, but its a no go!!


Gman94

join:2007-11-01
reply to onDvine

Avast started reporting thigns such as SkypePM, adawareinstall.exe, and multiple others as this trojan. I did delete a few, and when rebooting to run a boot-scan I found this post, and stopped the scan immediately. Luckily, nothing important was deleted.



Cid

@isp.belgacom.be
reply to onDvine

I got the same situation, virus definitions file version 091203-0 reports the same malware on different files.

Previous version 091202-1 on a different computer does not report any problem with the same file.



Peu

@sterlingstudents.net
reply to onDvine

Same here Gman, luckly I went to my itouch and search this names on safari when It was reboting for scaning. only few little programs were affected.



DylanBoy

@216.132.134.x
reply to onDvine

Same Avast! alerts appearing on my stand alone (w/ T1), and referencing all Macrium Reflect and Timeslips software apps. Popped up while doing nothing. Recommends "move to chest," but now will not allow me to do so, claiming subject file is "being used by an other process." Super.


Mele20
Premium
join:2001-06-05
Hilo, HI
kudos:5
reply to onDvine

I have Avast 5 beta 2 on a Vista virtual machine that had not been running for four days. I just booted it and Avast did a MAJOR upgrade...not just definitions but major upgrade and then announced it had to reboot the computer. I allowed that and BAM! I noticed HostsMan was not in the systray. So, I tried to start it only to get the alert about it being a trojan.

What particularly irritated me was that I was NOT offered the choice of "No Action"! Nor was I offered the choice of renaming. I could delete or move to chest. Plus, I could not take a screen capture which I could before this major upgrade of the beta. Gadwin Print screen started with a blank box! And the the Avast alert screen disappeared when I tried to draw a rectangle around it to make a screen shot. Then Gadwin Print Screen froze. Then Avast said Gadwin Print Screen was the same trojan that everyone is seeing.

Then Avast announced that Explorer.exe was a trojan! GEEZ!!! I had to completely shut down Avast.

I can't believe this happened right after I had been praising Avast's improvement in the False Positive ratings at AV-Comparatives. This is a major mess for Avast.
--
When governments fear people, there is liberty. When the people fear the government, there is tyranny. Thomas Jefferson



Grimm43
You Never Hear The One That Kills You
Premium
join:2000-11-02
Largo, FL
reply to Gman94

Mine flagged three processes from Faronics and Spybot both of which I know are clean..

Virustotal says they are clean too.



Algernon

@comcast.net
reply to onDvine

Same issue, only I am using G-Data (that uses an AVAST engine), it is flagging Iobit Advanced System Care files.



eggbored

@ntl.com
reply to onDvine

Yep getting it with kmplayer. Now I can't use it. This is the sort of thing that makes me switch to other programs. Not good.



arggem
Done With D.U.N.
Premium
join:2002-09-21
Argentina
reply to onDvine

Ditto: with Skype, Spybot, and Copernic DTS.



ff1324
Everybody Goes Home
Premium
join:2002-08-24
On Four Day
reply to onDvine

Yeah...it doesn't like DVDFab either. It flagged the vso_hwe.dll file as being the same trojan indicated above.



buttoni
Premium
join:2005-08-16
Temple, TX
reply to onDvine

Gee, I uninstalled Avast to try out Microsoft Security Essentials a few weeks ago. The gods are smiling on me maybe? I just tried to access their support forums and NO GO! Guess they're forum server is swamped with users trying to get in to report the problem.



luckyj

@optonline.net
reply to onDvine

I'm having the same issues - keeps reporting Trojans in memory files and system files mostly related to spyware detection/removal.

So far I've had alerts for Spybot, Webroot Spysweeper and Tun Up Utilities. All of these programs have been fine in the past and have never alerted.

What the heck happened???



CoolC

@bellsouth.net
reply to onDvine

Im using avast pro and it just updated then said that Skype had a trojan WIN32delfMZG



z75

@rr.com
reply to onDvine

OMG, everything has this virus?
It is happening to me too all of a sudden. I know none of these are viruses because i have been using it for such a long time. FP.



Annoyed

@metrocast.net
reply to onDvine

Anyone have a fix? I was able to choose no action in my case, but it still won't allow me to open my Guitar Pro files...



Johnnyhel

@commslogic.com.au
reply to onDvine

As above, found a file in Spybot. Ive moved the file to the chest, however will shutdown avast for the time being so other programs dont get crippled.



Hoggos

@netspace.net.au
reply to onDvine

I am getting the same thing on Win XP SP3. It found the trojan in EditpadLite and Skype.

I looked up what the trojan does. It copies exe files from filename.exe to filename.exe.exe and then launches a birthday message on 14th May.
I scanned my system looking for files with a exe.exe extension and found none - I assume that it is a false positive.