Autorun.exe marked as virus

[Cosmin]

Hi Andrew,

Indeed this is a false positive. We are aware of the problem and will contact the antivirus publishers to rectify it.

Regards,
Cosmin

[tommyh1122]

Hello,

Could you verify if this has been resolved. When I compile Avira Antivir is saying I have a virus on the autorun.exe file.


Thank you
Michael

[Bogdan]

Hi Michael,

Can you please tell us what version of Advanced Installer are you using? Also, is your antivirus up to date?

I'm asking this because we have done a couple of tests with version 8.2 of Advanced Installer and using the latest version from Avira but
no detection was signaled.

Regards,
Bogdan

[Cosmin]

Hi,

Are you using the latest version of Advanced Installer (8.2)?

Regards,
Cosmin

[tommyh1122]

Thank you for the quick response.

I am running Advanced Installer 8.2 build 35753. The virus that is being detected is the TR/Crypt.XPACK.Gen3 from AntiVir and only on the autorun.exe files from advanced installer, no other files are showing as infected.

Please let me know, we have people worred that our software is/will install a virus on their machines.

Thank you
Michael

[Bogdan]

Hi Michael,

I have made a new submission of autorun.exe and the complete setup package of Advanced Installer to Avira team. The preliminary report showed
that the EXE is clean, i.e. no detection was made. I'm still waiting the for full results.

Do you have a clean machine on which you can install a fresh copy of Advanced Installer downloaded from our web site and your antivirus, in order
to perform a new scan? This is just to make sure your current build computer is not infected.

Regards,
Bogdan

[tommyh1122]

Hello,

Was touching base to see what the results were from the submission to the Avira team.

I did take the package that Advanced Installer created to another computer running a different virus scan that was up-to-date and did not find anything. Looks like only the Avira virus scan is making this detection and only on the autorun.exe files from Advanced Installer.

Can you please let me know if this is a false positive so that I can pass that along to my customers.


Thank you
Michael

[Cosmin]

Hi Michael,

This is the response we got from Avira team:

Dear Sir or Madam,

Thank you for your email to Avira's virus lab.
Tracking number: INC00788162.

A listing of files alongside their results can be found below:
File ID Filename Size (Byte) Result
48574788 autorun.exe 7 KB KNOWN CLEAN

Please find a detailed report concerning each individual sample below:
Filename Result
autorun.exe KNOWN CLEAN

The file 'autorun.exe' has been determined to be 'KNOWN CLEAN'.In particular this means that we could not find any malicious content. Please note that the file is part of 'Advanced Installer for Java 8.2'.

Please note: If you have specific questions please address them to support@avira.com

Kind regards
Avira Virus Lab

So it's a false positive. The latest Avira updates should recognize it correctly.

Regards,
Cosmin

[sdk]

hello,

i have the same problem !

Latest Version of Avira Antivir Personal 10.0.0.652 Date 20.07.2011
Advanced Installer 8.1.1 Build 34572

[Bogdan]

Hi,

The file should be cleared now. Have you tried using the latest version of Advanced Installer, i.e. version 8.3?

Regards,
Bogdan

[Bogdan]

Hi,

This is the response we got from Avira team, after I have submitted "autorun.exe" from version 8.1.3 of Advanced Installer:

Dear Sir or Madam,

Thank you for your email to Avira's virus lab.
Tracking number: INC00800443.

A listing of files alongside their results can be found below:
File ID Filename Size (Byte) Result
26250905 autorun.exe 7 KB CLEAN


Please find a detailed report concerning each individual sample below:
Filename Result
autorun.exe CLEAN

The file 'autorun.exe' has been determined to be 'CLEAN'.Our analysts did not discover any malicious content.

Alternatively you can see the analysis result here:
http://analysis.avira.com/samples/detai ... tid=800443

An overview of all your submissions can be found here:
http://analysis.avira.com/samples/detai ... EqOKHCfymm

Please note: If you have specific questions please address them to support@avira.com

Kind regards
Avira Virus Lab

Regards,
Bogdan