BDRebuilder v4505: AVG detected 2 virus-suspicious acts in tools sub-dir

[gll99]

I downloaded BDRebuilder (BD-RBV04505.zip last version Nov 20, 2013, filesize 26.6MB, 27,281KB) from the direct link on this site. I was shrinking a BD50 to BD25 already ripped to hdd. Just before the half way point AVG kicked in and deleted x264.exe and asked for a reboot to deal with wavi.exe. It identified the threats as "General Behavioral Detection".

What gives? Is this a false positive from AVG or have some tools BDrebuilder uses been compromised.?

[aedipuss]

hehe bummer - get rid of avg it started sucking really badly years ago.

[gll99]

hehe bummer - get rid of avg it started sucking really badly years ago.

I'm not ready to blame AVG just yet

[aedipuss]

i dumped it on 3 computers and haven't had a false positive(or an infection) in a couple years using the free version of norton security suite from comcast.

[nic2k4]

Whenever you're in doubt take it to VirusTotal.

[aedipuss]

here a norton scan of the zip. i've used the program multiple times to completion and aren't infected.

[gll99]

I submitted x264.exe to jotti.org and only 1 of 23 online checkers reported a problem. Clam.av said it was infected "PUA.Win32.Packer.InterplaysMveFi".

Best I could find was someone's comment on this site http://forums.clamwin.com/viewtopic.php?p=15591

......PUA detection (Potentially Unwanted Applications) is for detecting files that are packed with packers used by malware or tools that could be used by malware (such as keyloggers, remote admin tools, some scripts, etc.). The problem is that both malware and "good" programs can use the same packers. Many "good" websites also use java scripts and other scripts that are put in your temporary internet folder that will be detected as PUA files. Many businesses use remote administration tools as well.....

I also tried wavi.exe but no threats were reported (0 of 23)

It looks like many Virus checkers just don't bother reporting PUA's because of the high probability of errors. If packers can be so easily misreported why would good apps use the stupid things to save some bytes? But if they go unreported then it also leaves a big hole. It seems like there is a valid cause for some concern if it really was as virus hidden in a packed PUA.