Possible Virus Analysis

Forums › Desktop computing › Possible Virus Analysis

Oubadah

676 posts

Ultimate Geek

#116966 15-May-2013 10:19

I have a .exe program file that Avast considers a virus. I've been using it for years, and neither ESET nor MSE had any problem with it, but Avast just brought it up in a full scan. I submitted it to Avast, but where else can I submit it with the objective of actually getting some feedback? Every AV company seems to take submissions, but it's no use to me unless I can get some kind of result to tell me whether the thing is in fact dodgy. How should I go about verifying that a file is clean?

xpd

Geek @ Coastguard NZ
13769 posts

Uber Geek

Retired Mod

ID Verified

Trusted

Lifetime subscriber

#817928 15-May-2013 10:22

Google the filename - but if youve been using it for years and otehr AV hasnt picked it up, its probably a false-positive and theres nothing to be concerned about.

Lot of AV picks up things such as keygens and VNC programs as potential threats, but they arent.

Gavin / xpd / FastRaccoon / Geek of Coastguard New Zealand

LinkTree

johnr

19282 posts

Uber Geek
Inactive user

#817930 15-May-2013 10:25

What is the .exe file?

Oubadah

676 posts

Ultimate Geek

#819988 15-May-2013 12:33

FEAR.exe, an No-CD crack for the game F.E.A.R.

Disclaimer: I own the game (x2 in fact), I just loathe disk juggling.

michaelmurfy

meow
13270 posts

Uber Geek

Moderator

ID Verified

Trusted

Lifetime subscriber

#820017 15-May-2013 13:07

Oubadah: FEAR.exe, an No-CD crack for the game F.E.A.R.

Disclaimer: I own the game (x2 in fact), I just loathe disk juggling.

And this is why you don't use cracks...

Michael Murphy | https://murfy.nz
Referral Links: Quic Broadband (use R122101E7CV7Q for free setup)

Are you happy with what you get from Geekzone? Please consider supporting us by subscribing.
Opinions are my own and not the views of my employer.

Dairyxox

1594 posts

Uber Geek

#820020 15-May-2013 13:12

Some people will say its definitely a virus now, considering the source (some cracker made the file, and distributed it over websites that dont have good standings).

AND

Its being picked up as a virus.

However thinking about it, the cracker probably used some dark arts (packed unsigned/non-byte-counted code), that avasts heuristics pickup as a virus.

So it might not be a virus. Doubt we'll ever know for sure. You're probably going to have to use your own discretion.

Oubadah

676 posts

Ultimate Geek

#820038 15-May-2013 13:30

michaelmurfy:
And this is why you don't use cracks...

Somehow I don't think this is going to put me off using cracks. Every disk checking game I own is cracked, and this is the first 'virus'. A 'virus' that I've been oblivious to for years as it's had zero detectable ill effect.

This is why I'm pretty sure it's another false positive. Maybe I'll archive it and wait to see if Avast change their mind after my submission.

michaelmurfy

meow
13270 posts

Uber Geek

Moderator

ID Verified

Trusted

Lifetime subscriber

#820042 15-May-2013 13:34

Oubadah:
michaelmurfy:
And this is why you don't use cracks...

Somehow I don't think this is going to put me off using cracks. Every disk checking game I own is cracked, and this is the first 'virus'. A 'virus' that I've been oblivious to for years as it's had zero detectable ill effect.

This is why I'm pretty sure it's another false positive. Maybe I'll archive it and wait to see if Avast change their mind after my submission.

Send it off to Virustotal and see what they say.

Sharesies

Trade NZ and US shares and funds with Sharesies (affiliate link).

robjg63

4100 posts

Uber Geek

Subscriber

#820043 15-May-2013 13:35

Depending on the size of it you could upload it to virustotal.com
The file has to be < 64mb for them to accept it.
Its a site that runs submitted files through something like 20 or 30 antivirus products then shows you the results.
Sometimes you can see that a couple of antivirus products will report something is a problem and everything else says its fine - in those cases its probably oversensitive AV products.

Its a good way of seeing what other antivirus products make of a file - and it's free...

EDIT: Aww - beaten by one minute!
OK - I second virustotal!

Nothing is impossible for the man who doesn't have to do it himself - A. H. Weiler

Oubadah

676 posts

Ultimate Geek

#820095 15-May-2013 14:29

michaelmurfy:

Send it off to Virustotal and see what they say.

robjg63: Depending on the size of it you could upload it to virustotal.com
The file has to be < 64mb for them to accept it.
Its a site that runs submitted files through something like 20 or 30 antivirus products then shows you the results.
Sometimes you can see that a couple of antivirus products will report something is a problem and everything else says its fine - in those cases its probably oversensitive AV products.

Its a good way of seeing what other antivirus products make of a file - and it's free...

Thanks.

It comes back with a 5/46 detection ratio

Avast: Win32:Dropper-gen [Drp]
GData: Win32:Dropper-gen
Ikarus: not-a-virus.Crack.FEAR
Symantec: WS.Reputation.1
TrendMicro-HouseCall: TROJ_GEN.F47V0716

There was also 7 user votes for and 0 against and a user comment stating that it's harmless.

Odd that Trend Micro likes it but Housecall doesn't.

1080p

1332 posts

Uber Geek
Inactive user

#820140 15-May-2013 15:15

This is almost certainly not a virus but just overly paranoid virus heuristics.