Virus found in Widefs zip file

[DEN19]

Just done a scan with AVG free edition on my fs pc and it has shown a virus in the Wide fs zip file. The virus is described as Win32/heur and has been removed to the virus vault.

Question is, is it really a virus or a false positive from AVG?

Den

[Pete Dowson]

Just done a scan with AVG free edition on my fs pc and it has shown a virus in the Wide fs zip file. The virus is described as Win32/heur and has been removed to the virus vault.

Question is, is it really a virus or a false positive from AVG?

False positive. The binaries in the ZIP are compressed and there's no real code it can check.

It is also rather odd that you get this and I don't, as I also use AVG free. My version is 9.0.819 with the Virus DB version 271.1.1/2893.

Regards

Pete

[DEN19]

Pete

Mine is also 9.0.819, database updated today before the scan to 271.1.1/2893 24 May 07.26hrs.

It showed it in the zip file and again in the .exe inside the zip file.

I've seen false positives before so I guess I'll just ignor it.

Thanks and regards

Den

[Pete Dowson]

Mine is also 9.0.819, database updated today before the scan to 271.1.1/2893 24 May 07.26hrs.

Odd that it's the same as mine and I don't get the indication! I even downloaded a fresh copy of WideFS.ZIP from the Schiratti site and still get a clean scan. Maybe you should re-download it in case it's become infected en route or at your ISP?

Regards

Pete

[Ian P]

What may be of interest to you is that "heur" normally refers to "heuristics", which are used by AV software (not just AVG - they all use some form of the technique) to try and spot viruses that are not yet included in the virus database by looking for "virus like behaviour".

Not always, but most often, when I have seen a heuristics detection of a virus, it's been a false positive where the AV software was unilaterally decided a file is a virus as a "better safe than sorry" option.

One of the reasons I stopped using AVG was because their heuristic routines got a bit trigger happy and started flagging up a lot of false positives. That was about a year ago.

Ian P.