avg detecting as a trojan

hardhatinc · Post by **hardhatinc** » 2008-02-21 14:42

why is my avg all of a suddenly detecting pchelpware as a trojan?

misterx13 · Post by **misterx13** » 2008-02-21 14:56

Can you provide more details? The text of the alert, etc? I have a client reporting they were hacked via pchelpware, but I am wondering if it couldn't be a false alarm from AVG.

hardhatinc · Post by **hardhatinc** » 2008-02-21 15:10

can i email it to you? i have a screenshot of it

neon_the_13 · Post by **neon_the_13** » 2008-02-21 15:51

I have the same problem, this afternoon's AVG update detect PCHelpWare as a trojan

Printscreen on
http://img88.imageshack.us/my.php?image=pchwavgqw2.jpg

Anybody knows whats going on?
N

hardhatinc · Post by **hardhatinc** » 2008-02-21 16:01

i'm trying to call avg right now. this happened with their most recent update. i can't even run my support program unless i uninstall avg

neon_the_13 · Post by **neon_the_13** » 2008-02-21 16:12

dont waste time, I've called there right know and I've send a rar with sample and description as well.

misterx13 · Post by **misterx13** » 2008-02-21 16:31

I can confirm that my client is also using AVG, and that AVG is identifying PCHelpware as trojan PSW.Agent.RWL.

Neon_the_13, let us know what you hear from AVG. Thanks for contacting them.

neon_the_13 · Post by **neon_the_13** » 2008-02-21 16:43

Nothing special, as normal phrases, "Pack with password and send to us".
I've done it, I have also attached information, what is this software about, gave them link to PCHw web and this discuss thread as well.

Let see, what the support guy will or will not do with this.

Additionally, I've tried uVNC SC and is false possitive as well.

Right now, I can't even image, what will come soon and how much clients of mine, will call me "what the hell, you infected my computer".... cause, I use PcHelpWare for any administration request for 200+ of my webhosting clients.....

In case, AVG guys will not do anythink, egh, lot of problems cannot be solved as fast as I became used to solve it.

Neon

johnhct · Post by **johnhct** » 2008-02-21 17:05

We're down as well. Are we sure the product is okay? Is it okay to shut down AVG and continue using pchelpware?

Thanks,

John

hardhatinc · Post by **hardhatinc** » 2008-02-21 17:07

turn off the resident shield temporarily

misterx13 · Post by **misterx13** » 2008-02-21 17:12

I ran helpware through the malware scanner at http://virusscan.jotti.org/ , here are the results:

Scan taken on 21 Feb 2008 16:52:14 (GMT)
A-Squared Found nothing
AntiVir Found nothing
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found PSW.Agent.RWL
BitDefender Found nothing
ClamAV Found nothing
CPsecure Found RemoteAdmin.W32.WinVNC-based.C
Dr.Web Found nothing
F-Prot Antivirus Found nothing
F-Secure Anti-Virus Found nothing
Fortinet Found nothing
Ikarus Found nothing
Kaspersky Anti-Virus Found nothing
NOD32 Found nothing
Norman Virus Control Found nothing
Panda Antivirus Found nothing
Rising Antivirus Found nothing
Sophos Antivirus Found nothing
VirusBuster Found nothing
VBA32 Found nothing

I have sent a copy of PCHelpware to CPSecure, with a request for clarification of their detection.

misterx13 · Post by **misterx13** » 2008-02-21 17:31

Bahaha! Email sent to CPSecure's virus submission box was rejected because of "Illegal attachment".

Oh well.

hardhatinc · Post by **hardhatinc** » 2008-02-21 17:37

File: PcHelpWare_SC_GUI.zip
Status: INFECTED/MALWARE
MD5: 5cc8127a10511d950b12e8b55f63d9f1
Packers detected: UPX
Bit9 reports: File not found

Scanner results
Scan taken on 21 Feb 2008 17:26:05 (GMT)
A-Squared Found nothing
AntiVir Found nothing
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
CPsecure Found RemoteAdmin.W32.WinVNC-based.C
Dr.Web Found nothing
F-Prot Antivirus Found nothing
F-Secure Anti-Virus Found not-a-virus:RemoteAdmin.Win32.WinVNC-based.c (6, 2, 606)
Fortinet Found nothing
Ikarus Found nothing
Kaspersky Anti-Virus Found not-a-virus:RemoteAdmin.Win32.WinVNC-based.c
NOD32 Found nothing
Norman Virus Control Found nothing
Panda Antivirus Found nothing
Rising Antivirus Found nothing
Sophos Antivirus Found nothing
VirusBuster Found nothing
VBA32 Found nothing

misterx13 · Post by **misterx13** » 2008-02-21 17:43

Hardhat, what did you do that scan with?

dfishin1 · Post by **dfishin1** » 2008-02-21 17:56

i am having same issue with AVG.

johnhct · Post by **johnhct** » 2008-02-21 17:57

It looks like AVG just did an update and pchelpware is working now.

Yea!!

John

misterx13 · Post by **misterx13** » 2008-02-21 18:02

johnhct ... thanks for the update, I'll ask my client to force an AVG update and rescan. I'll post back with results.

hardhatinc · Post by **hardhatinc** » 2008-02-21 18:03

thanks to all who contributed!!!!

hardhatinc · Post by **hardhatinc** » 2008-02-21 18:06

i updated mine and it works now

YAY!!!

neon_the_13 · Post by **neon_the_13** » 2008-02-21 20:03

I have reply from AVG support

(czech version, my english poor translation will follows)

CZECH
================
Dobry den,

dekujeme Vam za zaslani emailu.

Drivejsi verze virove baze AVG bohuzel detekovala zminenou infekci na
korektnich souborech. Nyni muzeme potvrdit, ze se jednalo o falesny
poplach. Zminena detekce byla odstranena v ramci nove virove baze,
proto bychom Vas chteli pozadat o aktualizaci programu AVG a opetovny
test zminenych souboru.

Omlouvame se za zpusobene komplikace.

S pozdravem,
Z.P.

ENGLISH
================
Hello,

thanks for your email

Previous version of virus DB has detected infection on correct files.
We can confirm, it was FALSE possitive
It was removed from next virus DB update, so please, update AVG and test it once more

We appologize for complications

Regards
Z.P.

______________________________

hardhatinc · Post by **hardhatinc** » 2008-02-21 20:08

which AVG version do ya'll use?

neon_the_13 · Post by **neon_the_13** » 2008-02-21 20:13

.... and I can confirm, after update, its all OK.

THANKs AVG people

Neon

neon_the_13 · Post by **neon_the_13** » 2008-02-21 20:16

Actually, 7.5.516
Virus DB: 269.20.9/1292
Release date: (21.2.2008, 16:09)
/I guest CEST/+1GMT time/

hardhatinc · Post by **hardhatinc** » 2008-02-21 22:56

do you have the pro or free version?

mcwtim · Post by **mcwtim** » 2008-02-22 16:46

The 1291 definition was the culprit. I submitted a report and a zip, AVG replied within an hour and had the 1292 update out (not sure if being a Grisoft affiliate helped speed things).

The same definitions are used by both the Free and Pro versions.

UltraVNC

avg detecting as a trojan

avg detecting as a trojan

Re: avg detecting as a trojan

Re: avg detecting as a trojan

Re: avg detecting as a trojan

Re: avg detecting as a trojan

Re: avg detecting as a trojan

Re: avg detecting as a trojan

Re: avg detecting as a trojan

Re: avg detecting as a trojan

Re: avg detecting as a trojan

Re: avg detecting as a trojan

Re: avg detecting as a trojan

Re: avg detecting as a trojan

Re: avg detecting as a trojan

Re: avg detecting as a trojan

Re: avg detecting as a trojan

Re: avg detecting as a trojan

Re: avg detecting as a trojan

Re: avg detecting as a trojan

Re: avg detecting as a trojan

Re: avg detecting as a trojan

Re: avg detecting as a trojan

Re: avg detecting as a trojan

Re: avg detecting as a trojan

Re: avg detecting as a trojan