ALERT - AWC 3.2 Virus Reported by Trend Micro

[waynes]

Today I downloaded Advanced SystemCarePro 3.2 from download.com, from the link posted on iobit.com. I installed but ran into a problem with AWC.EXE so I unloaded my Trend Micro Client Security Agent antivirus and was then able to finish installation.

 

I rebooted and went to load AWC but it was not there anymore. I opened Trend Micro real-time monitor and it says the following:

 

Last virus/malware found: WORM_HUPIGON.YFZ from C:\Program Files\IObit\Advanced SystemCare 3\AWC.EXE

 

Scan statistics

Infected files: 1

 

Is this a false positive, or is AWC really infected? I've never had this problem with Trend Micro before, so I tend to believe what it is telling me, but at the same time I cannot find any info on WORM_HUPIGON.YFZ.

 

In any case, I cannot run AWC now. Anyone know what the deal is?

[enoskype]

Hi waynes,

 

It must be a false positive.

 

There is no malware in IObit products.

 

Take it out from the vault of Trend Micro.

 

Go to ASC 3 version 3.2 is released thread and download the setup file from MajorGeeks, unblock it from setup file's properties.

 

Before installing, unload Trend micro, and install ASC with Admin rights.

 

After installing please read all posts in USAGE of IOBIT PRODUCTS thread.

 

If you hae any suspicion, you can upload any file in http://www.virustotal.com/ to be checked.

 

Check the post of Tim Xue, the author of ASC here .

 

Cheers.

[kfletch22]

ALERT - AWC 3.2 Virus Reported by Trend Micro

 

I have been running Advanced System Care for only 3 days now. I keep getting a popup from a program running on my computer called PC Cillin that keeps notifying me of the WormHupigonYFZ virus is found in the Advanced System Care.exe file. I uninstalled A.S.C. and tried to reinstall only to be denied because of the virus on install. Has anybody else had this problem? Should I ignore the issue as a problem with PC Cillin or not use Advanced System Care? Thank you to anybody willing to take their time to answer.

[work2832]

same problem

 

i'm havin the same problem except i haven't uninstalled n mine is in AWC.exe...wheres all the help here

[kfletch22]

AWC.exe

 

Yes, mine is in AWC.exe, sorry I put the wrong file name in the original post.

[work2832]

i have the same virus but haven't uninstalled n the program seems to be workin ok...wat is a false positive...wats with this worm n how did it get there

[work2832]

check out the postin by waynes titled ALERT - AWC 3.2 Virus Reported by Trend Micro

[kfletch22]

I am having the same problem. Could somebody please explain in more detail how to do the fix. I have already un-installed and need to know how to go about removing the notification from Trend Micro. Also, some of the steps mentioned above seem to be a little more advanced than I am used to. Sorry.

[solbjerg]

Hello work

Check out this answering link

Post 18. False Positive Alerts about ASC 3 by Security Programs

http://forums.iobit.com/showthread.php?p=14243#post14243

Cheers

solbjerg

 

 

check out the postin by waynes titled ALERT - AWC 3.2 Virus Reported by Trend Micro

[detailer]

Hey work-Can you point me at that post you are referring to?Just a guess,but it sounds like both of you are infected.There are no infections associated with Iobit products,but a bug could have attached itself to one or more of it's files.Need a little more specific info to work with you.Sorry if half an hour was too long to wait.

[detailer]

Sorry work can't keep track of you in two threads(getting old)I missed the TM thread but now I'm with you-a false positive is something perceived by your security as an infection or problem,when indeed it is not.High sensitivity settings can account for false detections.Enoskype's post is right on the money.My opinion of your being infected is reversed.

[solbjerg]

Hi

A virus in an install file from a known company is - if not impossible - so very close to that, as to be very, very damned unlikely.

One of the parameters for exellence for anti-virus programs ought to be how few false positives they have.

Cheers

solbjerg

 

 

Sorry work can't keep track of you in two threads(getting old)I missed the TM thread but now I'm with you-a false positive is something perceived by your security as an infection or problem,when indeed it is not.High sensitivity settings can account for false detections.Enoskype's post is right on the money.My opinion of your being infected is reversed.

[work2832]

i used trend virus scan n it querantined the virus n everythin seems to be workin fine... actually everytime i open ASC the virus shows up again

[Valuater]

Because people trust so much in their Anti-Virus.

 

It is hard to know how many customers IObit has lost.

 

.... a very sad fact!

 

8(

[work2832]

detailer

 

thx thats wat i thought its not harmful but how it got there i have no idea...i've had AWC for a few weeks n today was the 1st day it showed up...does anyone no how i can get rid of the notification from trend

[detailer]

Trend Micro

 

Hi work-Not familiar with Trend-one of the very few I haven't used.A recent definition update from Trend has probably caused the sudden appearance of the warning.Is there some sort of ignore list in that utility? If you give me the exact name and version of that utility.I'll see if I can download a trial version so I can look through it's settings-It is a paid version,correct?-Update-I can download Internet Security,Internet Security Pro,or AntiVirus plus AntiSpyware-from their website.

[work2832]

Yes Its A Paid Version...internet Security 14

[budmeister]

Hello, everyone! Once you have the same question, you can upload it to http://www.virustotal.com, then you can see the result.

 

First, those reports are 100% false positive. The MadException is the compnent that collect, generate and feedback the bug report of our prouct. As it will inject our main program to debug at runtime, so some anti-virus product thing it is a virus. But this component is added by us to debug. Also PCTools' Spyware Doctor and Registry Mechanic use MadException as well, but the different is they include the Bpl file into their .exe program file. And the CoolTray bpl is the component of the SysTray.

 

You can visit http://madshi.net/madExceptDescription.htm to check what MadException is.

 

Also you can search "Spyware doctor MadExcept" and check the result, http://www.google.com/search?hl=en&q=spyware+doctor+madexcept&btnG=Google+Search&aq=f&oq=, you will find that PCTools use Mad Except as well.

 

Here's the VirusTotal results. Note Trend Micro:

 

AWC.exe received on 04.01.2009 01:39:34 (CET)

Current status: finished

 

Result: 1/40 (2.50%)

Compact Print results

Antivirus Version Last Update Result

a-squared 4.0.0.101 2009.03.31 -

AhnLab-V3 5.0.0.2 2009.03.31 -

AntiVir 7.9.0.129 2009.03.31 -

Antiy-AVL 2.0.3.1 2009.03.31 -

Authentium 5.1.2.4 2009.03.31 -

Avast 4.8.1335.0 2009.03.31 -

AVG 8.5.0.285 2009.03.31 -

BitDefender 7.2 2009.04.01 -

CAT-QuickHeal 10.00 2009.03.31 -

ClamAV 0.94.1 2009.03.31 -

Comodo 1092 2009.03.31 -

DrWeb 4.44.0.09170 2009.04.01 -

eSafe 7.0.17.0 2009.03.31 -

eTrust-Vet 31.6.6427 2009.03.31 -

F-Prot 4.4.4.56 2009.03.31 -

F-Secure 8.0.14470.0 2009.04.01 -

Fortinet 3.117.0.0 2009.04.01 -

GData 19 2009.04.01 -

Ikarus T3.1.1.49.0 2009.03.31 -

K7AntiVirus 7.10.687 2009.03.31 -

Kaspersky 7.0.0.125 2009.03.31 -

McAfee 5570 2009.03.31 -

McAfee+Artemis 5570 2009.03.31 -

McAfee-GW-Edition 6.7.6 2009.03.31 -

Microsoft 1.4502 2009.04.01 -

NOD32 3978 2009.03.31 -

Norman 6.00.06 2009.03.31 -

nProtect 2009.1.8.0 2009.03.31 -

Panda 10.0.0.14 2009.03.31 -

PCTools 4.4.2.0 2009.03.31 -

Prevx1 V2 2009.04.01 -

Rising 21.23.12.00 2009.03.31 -

Sophos 4.40.0 2009.03.31 -

Sunbelt 3.2.1858.2 2009.03.31 -

Symantec 1.4.4.12 2009.04.01 -

TheHacker 6.3.3.9.298 2009.04.01 -

TrendMicro 8.700.0.1004 2009.03.31 WORM_HUPIGON.YFZ

VBA32 3.12.10.1 2009.03.31 -

ViRobot 2009.3.31.1669 2009.03.31 -

VirusBuster 4.6.5.0 2009.03.31 -

[reaper727]

wtf i got this too

 

why did everyone just get this yesterday?

online circulating viruses?

i got it 1 hour ago

and my comuter is being dumb about it

 

 

i dont think its a false positive

uninstallable on every computer i try

not allowed by trend micro

also norton, kaspersky, and some other anti virus stopped me from installing

this hupigon thing brought up 29 ".tmp" files into my quarantined infected files section.. is it a bug?

[budmeister]

Eliminate Trend Micro False Positive

 

Here's what 'should' work:

 

Open PC-Cillin Main Console

Click "Virus & Spyware Controls" tab

Click "Settings" in "Protection Against Viruses

The first tab is "File Monitor"

Anybody with problems obviously has the "Activate the File Monitor" box checked.

 

Click "Select Files or Folders"

Click "Add File" and search for C:\Program Files\Iobit\Advanced SystemCare3

Open that folder and click on "AWC.exe" to add it to the exception list.

 

I haven't tried it, but I will force a scan with PC-Cillin, go to bed and hope for the best! I've also done every scan possible for the Conflicker Worm and trust it isn't lying in wait deep within the bowels of my computer, waiting for the stroke of midnight, which takes EST into APRIL 1. <g>

[Valuater]

Reaper, with "millions" of downloads, IObit would not make the mistake of creating a malicious program... yes millions!

 

just 1 little flick of the switch by an Anti-Virus company and thousands of people find a Virus in ASC. Hmmm...???

 

That's way to much power when it is not controlled correctly!

... and obviously, it is not under control!

 

There are no viruses or malicious actions in Advanced SystemCare!

 

Valuater

An Independent Programmer

8)

[Valuater]

BTW.... Mark my words.......

 

It will be me defending XSkin from some Anti-Virus company next week! ... and I will loose good people using ASC too!

 

Valuater

8)

[Doberman]

Cannot install

 

When I try to install ASC I get anerro message:

an error occurred while trying to rename a file in the destination directory:

Move File failed; code2

The system cannot find the file specified.

 

Anyone have an answer to this problem?

[jamieg25]

i am not even able to install version 3.2 since all i ever get is a code 2 error for not being able to re name a file in the folder from the 3.1 version

 

how do you get past the not able to re name the file error since completely deleting the folder doesnot make the problem go away

[solbjerg]

Hi Jamie

An absolutely clean uninstall and then an absolutely clean install might solve your problem.

Please read the relevant posts in USAGE of IOBIT PRODUCTS

Be sure that no related automatic functions is running in the background

Cheers

solbjerg

 

 

i am not even able to install version 3.2 since all i ever get is a code 2 error for not being able to re name a file in the folder from the 3.1 version

 

how do you get past the not able to re name the file error since completely deleting the folder doesnot make the problem go away