Trojan Generic5

newtonm · Post by **newtonm** » 2007 Jul 12, 11:00

Downloaded and registered(and paid) yesterday 07/11/07, installed and ran perfectly. Alsoran early this morning (07/12/07) until after AVG automatic update around 07:30 BST. Now it reports virus, won't run, won't reinstall, totally kaput.

Obviously something is wrong and I have to suspect AVG, incidentally it doesn't work if you disable AVG either.

What now ???

eugenemcardle · Post by **eugenemcardle** » 2007 Jul 12, 11:03

My system locks up if I even open the xplorer2 folder; I am unable to send the file for analysis. I have uninstalled the program and will go back to Free Commander. I doubt this issue will be resolved so long as the blame game and the name calling continues.

Post by **nikos** » 2007 Jul 12, 11:06

What now ???

you can help speed up this recovery if you (all) report this to AVG using their proper false alarm channels

thanks

clarioneer · Post by **clarioneer** » 2007 Jul 12, 11:12

My apologies if i seemed a little accusational... like most users i draw something to your attention and await a fix asap lol... whether the problem is real or not... a fix plz...

As for guaranteed virus free i would expect you to be running your stuff thro all major anti-virus checkers... I would also not assume that a hacker couldn't have hacked into an online version of your software... the fact your PC is checked doesn't necessarily mean an uploaded version is as secure...

Will i ignore any false +ve NO... will i hack the virus checker to remove the false +ve nope lol... that would be very very stupid!

BRX · Post by **BRX** » 2007 Jul 12, 11:15

Just FYI here's the result page of the link I posted

File xplorer2_UC.exe received on 07.12.2007 13:08:53 (CET)
Current status: finished

Print results Antivirus Version Last Update Result
AhnLab-V3 2007.7.12.1 2007.07.12 no virus found
AntiVir 7.4.0.39 2007.07.12 no virus found
Authentium 4.93.8 2007.07.12 no virus found
Avast 4.7.997.0 2007.07.12 no virus found
AVG 7.5.0.476 2007.07.12 Generic5.GRL
BitDefender 7.2 2007.07.12 no virus found
CAT-QuickHeal 9.00 2007.07.12 no virus found
ClamAV devel-20070416 2007.07.12 no virus found
DrWeb 4.33 2007.07.12 no virus found
eSafe 7.0.15.0 2007.07.10 no virus found
eTrust-Vet 30.8.3781 2007.07.12 no virus found
Ewido 4.0 2007.07.12 no virus found
FileAdvisor 1 2007.07.12 no virus found
Fortinet 2.91.0.0 2007.07.12 no virus found
F-Prot 4.3.2.48 2007.07.11 no virus found
Ikarus T3.1.1.8 2007.07.12 no virus found
Kaspersky 4.0.2.24 2007.07.12 no virus found
McAfee 5072 2007.07.11 no virus found
Microsoft 1.2704 2007.07.12 no virus found
NOD32v2 2394 2007.07.11 no virus found
Norman 5.80.02 2007.07.12 no virus found
Panda 9.0.0.4 2007.07.12 no virus found
Sophos 4.19.0 2007.07.06 no virus found
Sunbelt 2.2.907.0 2007.07.12 no virus found
Symantec 10 2007.07.12 no virus found
TheHacker 6.1.6.145 2007.07.12 no virus found
VBA32 3.12.0.2 2007.07.12 no virus found
VirusBuster 4.3.23:9 2007.07.11 no virus found
Webwasher-Gateway 6.0.1 2007.07.12 no virus found
Aditional information
File size: 801280 bytes
MD5: 9d5c3a64d3691d92d6420aa1442108d7
SHA1: 9e816ea0ad80c5571a0ed8cb1ae46c94b7e7b921

Speaks for itself (and against AVG). Try yourself if you like.

newtonm · Post by **newtonm** » 2007 Jul 12, 11:20

Ran the setup file through "VIRUS TOTAL" all negative including AVG except for eSafe 7.0.15.0 2007.7.10 "Suspicious Trojan Worm" and Panda 9.0.0.4 2007.7.12 " suspicious file"
Sorry I didn't note which version of AVG was used. My current version shows 7.5.476

armsys · Post by **armsys** » 2007 Jul 12, 11:44

BRX,

Are you implying AVG itself is infected?
AVG 7.5.0.476 2007.07.12 Generic5.GRL is exactly the same version I have now.

Armstrong

FrizzleFry · Post by **FrizzleFry** » 2007 Jul 12, 11:58

It is not that AVG is infected with a virus but more likely that the latest update included an incorrect or too generic virus signature.

What is really annoying is that they have no info on this "generic5" virus on their virus database.

After checking x2 with VirusTotal I felt confident that this was an AVG problem so I disabled the resident virus shield temporarily.

clarioneer · Post by **clarioneer** » 2007 Jul 12, 12:02

haha the discussion is not about virus checkers per se but because one finds something and none of the others, does that necessarily mean the one that did is in error lol...

if you are able to perform this check it should be the authors of xplorer that should be doing it to check code they have added hasn't created this problem ? or if the problem exists mention it in their notes..

If this had been brought to light by xplorer guys as a false +ve in their notes - that i would have been happier with... as they didnt i rightly assume the worst!

realmnot · Post by **realmnot** » 2007 Jul 12, 12:12

Hi all,

here is AVG's response. Don't know if it realy helps!

Nicolas

Dear Sir/Madam,

Thank you for your email.

Unfortunately, the current virus database may detects virus on some
legitimate applications. We can confirm that it is a false alarm. We will
release the new virus update that removes the false positive on this
application. Please update your AVG and check your files when the update
is released.

If you need to restore deleted files from AVG Virus Vault you can do it
this way: open AVG Virus Vault (Start -> Programs -> AVG Antivirus ->
AVG Virus Vault). Locate the file that was removed, right click on it
and choose "Restore File(s)" option.

We are sorry for the inconvenience.

Best regards,

Mirek Makovec
AVG Technical Support

website: http://www.grisoft.com
mailto: technicalsupport@grisoft.com

FrizzleFry · Post by **FrizzleFry** » 2007 Jul 12, 12:20

Well they are confirming that it is a false positive and hopefully they will get it fixed sometimes today. I have been checking for updates every hour or so this morning. It would be nice if they put some info on this on their web site.

BRX · Post by **BRX** » 2007 Jul 12, 12:33

armsys wrote:BRX,

Are you implying AVG itself is infected?
AVG 7.5.0.476 2007.07.12 Generic5.GRL is exactly the same version I have now.

Armstrong

No, as you may have concluded yourself by now Virustotal is a webservice checking supplied files with all those scan engines.

Also, clarioneer, be fair here. Do you really expect developers in general and Nikos in specific to check each virus pattern update and each upgrade of every scan engine? After all this the 1.7.0.4 release was before the update of AVG (not to mention it was the only false positive of all listed engines above). Sorry, IMHO you're out of line here.

armsys · Post by **armsys** » 2007 Jul 12, 12:42

BRX,

Thanks for your explanation. Sorry for my misunderstanding.

Armstrong