AVG Virus Alert [RESOLVED]

[Ken Cox]

Just a thought -- to help Igor isolate the problem, has anybody tried the following steps

when you download the file - run your av and malware programs on the file

unpack the file and do the same on the program installer

once installed run your av and malware programs on the pte exe

from what i have read everybody has encountered the problem when thy make an exe -- what about the other options -- avi, mpg etc?

ken

[nobeefstu]

Most cases I have seen in the past are of anti-virus programs having false positive issues with compiled EXE using a EXE packer.

As a test and temporary workaround to be able to Publish a EXE so AVG does not flag the file :

Try disabling the UPX.exe packer. To disable the UPX.exe packer ... just rename the file.

You can find the UPX.exe file in the PTE program folder:

\Main\All\Components\UPX\upx.exe

Once you rename the UPX.exe ... Publish or compile your slideshow EXE and see if AVG still flags the file.

Please Note:

*This is only a temporary measure to Publish which may workaround the current AVG issue . This workaround will not resolve AVG flags of files already published with UPX.exe packer. If the files you Publish without UPX.exe packer are now working correctly with AVG ... this still does not resovle the current AVG issue. Donot send the workaround EXE files that now work correctly to AVG for testing.

*Restore/rename the UPX.exe file once AVG sorts out its issues.

[Ken Cox]

Stu

would this suffice

Once you rename the

UPX.exe

to

UPX.exe.old

ken

[David Porter]

Now here's an interesting fact. The "virus" that AVG is detecting = Trojan horse FakeAV.SYJ" does not have an entry in the Virus Encyclopedia on the AVG website. So they are "detecting" a virus that they can give a name to but for which they have no details on their own information database. Curiouser and curiouser!

regards,

Peter

I have just Googled the virus and got an AVG document listing many viruses included in an update (not sure which date and.SYJ was not among them) but entered about six different sorts in the Virus Encylopedia and all of them came back as not being found. My faith in AVG is now at zero.

[Ken Cox]

see

http://gsa.ca.com/virusinfo/virus.aspx?ID=170675

according to

http://gsa.ca.com/virusinfo/removal.aspx?ID=170675&PROD=21

it is still under investigation

for xp see

http://www.ca.com/us/Support/gsa/Security-Advisor-News-and-Information/Security-Advisor-Information/Disabling-System-Restore-on-Windows-ME-and-XP.aspx

ken

[davegee]

I prepared a 1Mb EXE specifically to send to AVG but it failed to send.

DG

[Ken Cox]

Dave

did you try disabling avg while you sent

I have done that in the past but i have antimalware running the background

ken

[nobeefstu]

Ken,

Stu

would this suffice

Once you rename the

UPX.exe

to

UPX.exe.old

ken

Renaming to UPX.exe.old should do nicely.

[HaroldB]

I also tried a one-slide show. It said it failed to send it to AVG.

I hope AVG resolves this soon... it's positively embarrassing.

H

[Leo Palmer]

When I use Pic2Exe 7 I keep getting AVG alerts for a Trojan Horse Fake AV. Pic2Exe hangs when I send the Trojan Horse to the Virus Vault.

I have reverted to Pic2Exe 6.5. Is there a fix?

[davegee]

See:

DG

[Ken Cox]

after talking with a friend last night I prepared to shut down

did an avg update and s/d

when I booted up this morn, I got a big surprise on my win 7system had 7 exes flagged by avg and think they were made with various versions of 7

I took them out of vault selected a folder and right away avg flagged it - I clicked ignore and opened the folder the exe I selected -- still no run

at present I have the following

avg ver 10.0.1410

db 1522/3947

updated 10/10/11 @ 1820

rechecked for an update this morning - i was up to date

in case you cant read the attachment i will continue the thread

so far the xp sp3 system has not flagged anything - it was also updated last night

avg flagged exe's

Tuesday, October 11, 2011

TOM -- DOLPHIN_BUBBLE_RINGS.EXE

MARK ALLEN\2011.EXE

MORASOFT\JINGLE BELLS KARAOKE.EXE

TOM- SEVEN_LITTLE_FOYS.EXE

MARK ALLEN\2011.EXE

TOM -- DOLPHIN_BUBBLE_RINGS.EXE

MORASOFT\JINGLE BELLS KARAOKE.EXE

ken

[davegee]

Ken,

What happens if you transfer a V7 EXE from your W7 to your XP.

It will flag it.

DG

[Leo Palmer]

Hello Dave, Ken and anyone else who has responded. I'm new to the forum and not certain how the replies work however my system is XP sp3 if that helps.

[Ken Cox]

DAVE

i might have the ones i posted but between writing, screenshooting and then swing to #1 system to check if things have got flagged have ran out of time -- also check your email asap

forum -- i apologize for not getting a complete screenshot naming the trogan

ken

[Leo Palmer]

Thanks, I just sent a report to AVG company about this false positive.

Please also send your reports to AVG company to speed solution of this problem.

Sorry for being "daft" but what is a "False Positive". I've switched back from v7 to v6.5 in order to use Pix2Exe, is v7 safe to use?

Leo

[Ken Cox]

I HAVE PINNED THE 2 CURRENT AVG THREADS TILL THINGS LEVEL OUT

I HAVE NOT THE NERVE TO TRY AND MERGE THEM -- IF ONE OF THE OTHER MODERATORS GOT THE NERVE GO FOR IT - THE ONE WHERE I POSTED THE SCREEN SHOT SHOULD BE MERGED WITH THE ORIGINAL THREAD

NO WONDER MY PRESSURE IS UP

KEN

[Ken Cox]

I CHECKED MY #1 SYTEM P2E FILES

just checked 2 of them

Tom's charlie chan - d/l sept 13 2011

and

Morasoft's 7 wonders of the world sept 25

both indicate bad

i would suggest people do not download any new files from wherever till this is sorted out -- i am going to lose a pile of exe's - i lost 30 gb of my own years ago but i have the original picts etc -- in this case i dont have the original picts

i do have exe's stored on mediafire

i have become lax this year as far as backing up to dvd all downloads i get so things are now at a standstill

FOR YOUR OWN GOOD

DO AS PETER SAYS AND HALT ALL P2E WORK THIS IS CLEARED UP

KEN

[davegee]

If you need to insert video into a show then you will have a problem publishing.

If you don't need to insert a video into a show you can still work in V7 but to publish the EXE you need to use V6.5.

When you need to Publish EXE open the show in V6.5 and Publish from there.

DG

[davegee]

I have just updated my AVG created a new show with V7.0.1, published it and all appears to be OK.

Anyone else care to confirm or otherwise?

DG

[Ken Cox]

Dave

win 7 system

i did another update - said it installed it - still the same ver/db #'s

checked Morasoft's file - still detects as bad

ken

[davegee]

Ken,

I have tried it a second time and it works OK - VISTA.

I was also able to run the original file that started the problem off for me without problems.

DG

[HaroldB]

I just updated AVG (AVG 11; Windows 7) and it does NOT work.

H

[davegee]

Harold,

You and Ken are both on Windows 7 - coincidence?

I updated to version 2012 a few days ago - maybe version 10 has not yet been updated?

DG

My version of AVG is 2012.0.1831

Database Version: 2090/4545

[Esc]

Ken and All!

I have uninstalled AVG and now all PtE.exe files works OK.

Also I have checked the start of The Dreams AV and I must say the intro in splendid.

Will run the complete sequence later.

I suspect it is a fake update to AVG 10 or a corrupt AVG 10 version. All was well until

updating to ver 10.

/Lennart