Re: Prob - AVG False Positive? - AdAware aawsepersonal.exe (V1.06) Detected as Trojan BackDoor DownLoader AQS?



In news:qSzcf.4632$Lw5.3698@xxxxxxxxxxxxxxxxxxxxxxxxxx,
pmj wrote:

> See Subject...
>
> Basically I came across an interesting (& annoying) little prob this
> (last) evening, during a Session in the BikeSheds with Sandra (Rabbit)
>
> She found that her AVG 7 (Free) AntiVirus thing that she uses is now
> Detecting the Current Install File for AdAware SE Personal V1.06
> (aawsepersonal.exe) as being Infected with a Trojan, which it Identifies
> as being Trojan BackDoor DownLoader AQS
>
> She has had (& used) the AdAware Se Personal 1.06 Install File
> perfectly OK, but within the last few Days, she has found that her
> AVG is picking it up as being a Trojan!!!
>
> It comes up with all sorts of scary Warnings & Dialog Boxes, with as
> many as 5 Options (as well as the Red X Close thing) & tries to
> put it in "Quarantine" & Deny access to it.
>
> It does that using its "Resident Protection" Scanner thing, when you
> just Open a Folder containing it...
> & also when the Download File is found on a Disk or USB Memory thing
> & when the File is being Downloaded from at least 2 reputable DownLoad
> Sites.
> & also when you do a Manual Scan of the File, using the RightClick
> Context Menu Extension to initiate an "On Demand" Scan (after we had
> finally managed to Download another Version of it, without having the
> DownLoad being intercepted by the "Resident Protection" thing, by
> turning the "Resident Protection thing off, temporarily).
>
> We had to jump through Hoops to get it to ignore it, so we could have
> a proper look at it.
>
> It seems fairly certain to me that it's actually just a "False Positive"
> P'raps cos of the "Heuristics" that AVG uses, to try to check things?
>
> But it still Identifies the File as being infected with a Trojan,
> even when the Heuristics Option is turned off.
>
> We did some Web Searching & couldn't find any references to it
> (the AdAware SE Personal 1.06 Install File) being wrongly identified
> by AVG 7, but we assume that it's just cos of one of the latest Virus
> Definition Updates that her AVG has?
>
> I'm wondering if anybody else who uses AVG 7 & also has the
> aawsepersonal.exe (1.06) Install File has come across this prob?
>
> I assume that AVG is just wrongly Identifying it - or maybe it thinks
> it's a DownLoader type Trojan, cos of the AdAware AutoUpdate facility
> that it uses?

Seems Sandra's not alone, there's a thread in 'alt.privacy.spyware' covering
the problem. Look for 'Strange virus ?' posted by 'Keith [Southend]' on
09/11/2005 at 19:44.
--
aa


.



Relevant Pages

  • Re: downloader.small.27.k
    ... | vault and then delete it and run AVG which finds nothing. ... | or so AVG catches another instance of this Trojan. ... This will bring up the initial menu of choices and should be executed in Normal Mode. ... You can choose to go to each menu item and just download the needed files or you can ...
    (alt.comp.anti-virus)
  • Prob - AVG False Positive? - AdAware aawsepersonal.exe (V1.06) Detected as Trojan BackDoor
    ... Detecting the Current Install File for AdAware SE Personal V1.06 ... as being Infected with a Trojan, ... AVG is picking it up as being a Trojan!!! ... & when the File is being Downloaded from at least 2 reputable DownLoad ...
    (uk.people.silversurfers)
  • Re: Trojan horse Downloader.Generic.ML
    ... Hi Ron - You might want to download and run the free or trial version of A2 ... Boot or Safe Mode with Show Hidden Files enabled. ... It's Grisoft free AVG ... > AVG claims it's found this trojan. ...
    (comp.security.firewalls)
  • Re: Trojan horse Downloader.Generic.ML
    ... Hi Ron - You might want to download and run the free or trial version of A2 ... Boot or Safe Mode with Show Hidden Files enabled. ... It's Grisoft free AVG ... > AVG claims it's found this trojan. ...
    (alt.computer.security)
  • Is this a virus?
    ... Download as an install file: ... Virus BAT/Delwin.AZ Quarantined. ... A trojan, also known as a trojan horse, is simply a program that pretends to ...
    (microsoft.public.windowsxp.newusers)