Trojan Horse found in FAVC105 - Please read before forming your opinions

[disturbed1]

This thread is becoming a virus

moviebuff2 - Thanks for expressing your concerns to the community. I thought that was kind and thoughtful. If someone doesn't like, trust, want a program so be it, and move on. I don't believe moviebuff2 did anything wrong. If I had a virus scanner pop up the message moviebuff2 did, I'd be in the same mind set.

Given how many people use FAVC, and this is the first report, it should be common sense to believe it is in fact a false positive. If that isn't enough a google search of what AVG found, brings up many hits of AVG showing this exact same false positive even in things like nVidia drivers, 7zip, or any program that uses SFX (self extracting installer).

And looking here - http://forum.grisoft.cz/freeforum/read.php?4,115058,backpage=2,sv= - confirms it was indeed a bug in AVG, that was just fixed in the recent update. So, in fact, AVG was entirely at fault in this case.

[AlanHK]

AlanHK wrote:

It found a SIGNATURE

OK AlanHK, you win. Goodbye VIRUSES. Hello SIGNATURES.
as in: "Oh, your pc is acting strangely? make sure it wasn't infected with a signature".
or: "That was a nasty signature, every one in our office lost some files".

So, you don't know what a signature is.

[VegasBud]

Since I'm always willing to learn something new...exactly how does anyone less than a virus analyst go about "confirming" the actual presence of a virus on a computer? You certainly couldn't use any anti-virus program I'm aware of, because they are entirely based on signatures, for obvious reasons.

Reporting any positive is a good thing, and should be encouraged. False positives are inevitable, and if handled in a timely manner (as it was in this case), just part of the price of security.

[AlanHK]

Since I'm always willing to learn something new...exactly how does anyone less than a virus analyst go about "confirming" the actual presence of a virus on a computer? You certainly couldn't use any anti-virus program I'm aware of, because they are entirely based on signatures, for obvious reasons.

Exactly. It's not confirmed. That's what should have been made clear at the outset.

You can crosscheck using other virus checkers, as they each will use a different signature database. That will give you a better idea of the risk.

Ultimately the test would be to run it in on a sacrificial machine (or an emulation, more conveniently) and see what it does. Not practical for most users, of course.

[mats.hogberg]

This thread has serverd its purpose. Conclusion:
Some virus scanners pick up a virus in FAVC.
This is a false positive.


/Mats