ALERT - AWC 3.2 Virus Reported by Trend Micro

[bearhntr]

Hi Jamie

An absolutely clean uninstall and then an absolutely clean install might solve your problem.

Please read the relevant posts in USAGE of IOBIT PRODUCTS

Be sure that no related automatic functions is running in the background

Cheers

solbjerg

 

This has not worked either.

 

I have used REVO UNINSTALLER and then CCLEANER to completely remove the program from my system and then cleared the TREND MICRO cache/QUARANTINE files.

 

I downloaded a fresh copy of AWS3.2 from the MajorGeeks Site and tried to install it. It blows up with an ERROR 2 trying to rename a file. Then TrendMicro catches the same WORM_HUPIGON.YFZ trojan, this time in a .TMP file (I guess the one that failed the rename from the installer).

 

The size of the file caught by TrendMicro is 2.16MB in size, and I would assume that this is the AWC.EXE file. If you click on the IGNORE button during the install - and let it complete. The AWSC shortcut in the folder is a BROKEN LINK icon (does nothing when clicked but give an error that AWC.EXE is not found).

 

Something is definately wrong, and I can see where many people would be afraid to install this. I will not attempt to re-install until this is worked out.

 

I did use the WEB BASED scanner mentioned earlier in this thread, and all 40 scans were clean - but none-the-less, the software will not install.

 

*BH*

[bearhntr]

Response from IOBIT Support

 

I have just received the following from IOBIT support from a message I sent to them this AM (I have [bLANKED] personal information from the message):

 

 

------------------------[begin]-----------------

Hi [bLANKED],

 

Thank you for writing back to us.

 

We are also sorry for the trouble.

 

It's a false positive. It's not a worm but it's a file named "madExcept_.bpl", which is used for collecting bugs in ASC Free.

 

So please disable Trend Micro temporarily or add this item into the Ignore List.

 

 

 

On Wed, Apr 1, 2009 at 9:18 PM, <[bLANKED]> wrote:

 

unregistered user [bLANKED] said:

 

I have been using your product ADVANCED SYSTEM CARE for a long while now (and I LOVE it). I cannot tell you the number of my friends and family that I have recommended it to.

 

Today, I was informed of a detected virus/trojan within the AWC.EXE file called WORM_HUPIGON.YFZ. The TRENDMICRO software quarantined the file, and now the software will no longer run.

 

How could this file have been infected? I see that others on the Internet ahve also had this file caught by McAfee and other virus scanners.

 

I am a little disturbed that this file has been found to have a trojan virus embedded. I have just installed it on this machine and today was the first time that a FULL VIRUS SCAN has run onthe system since it was installed.

 

I am not happy that your program appears to contain a virus. It would not be feasible for me to continue using the software or recommending it if you are passing viruses to people that download your software.

 

Sincerely and very unhappy,

[bLANKED]

===================

Product:Advanced SystemCare Free 3

Version:3.0

ComputerType:Daily Use

NetworkType:LAN

Windows Version:Windows XP

Service Pack: 3

License :

Order :

===================

User's Company:

From:[bLANKED]

 

 

 

--

 

Best Regards

 

Sincerely,

Joanne

 

iObit.com

http://www.iobit.com

------------------------[end]-----------------

 

Problem is that TrendMicro does not have an IGNORE mode.

 

*BH*

[kfletch22]

Instructions

 

I found the below link to explain how to set an ignore for a file or folder in Trend Micro (PC Cillin) . http://esupport.trendmicro.com/Pages/How-can-I-prevent-the-Real-time-Virus-Protection-of-Trend-Micro-PC-cil.aspx

 

I am still concerned about why other programs (besides Trend Micro products) are finding this same issue.

[bearhntr]

I found the below link to explain how to set an ignore for a file or folder in Trend Micro (PC Cillin) . http://esupport.trendmicro.com/Pages/How-can-I-prevent-the-Real-time-Virus-Protection-of-Trend-Micro-PC-cil.aspx

 

I am still concerned about why other programs (besides Trend Micro products) are finding this same issue.

 

 

kfletch,

 

Thanks for the info, but I am not running PC-cillin. It is OfficeScan, and the options/settings listed on that page do not exist.

 

Thanks,

*BH*

[enoskype]

Hi guys,

 

Please check post #20 of this thread.

 

Cheers.

[budmeister]

Here's what 'should' work:

 

Open PC-Cillin Main Console

Click "Virus & Spyware Controls" tab

Click "Settings" in "Protection Against Viruses

The first tab is "File Monitor"

Anybody with problems obviously has the "Activate the File Monitor" box checked.

 

Click "Select Files or Folders"

Click "Add File" and search for C:\Program Files\Iobit\Advanced SystemCare3

Open that folder and click on "AWC.exe" to add it to the exception list.

 

I haven't tried it, but I will force a scan with PC-Cillin, go to bed and hope for the best! I've also done every scan possible for the Conflicker Worm and trust it isn't lying in wait deep within the bowels of my computer, waiting for the stroke of midnight, which takes EST into APRIL 1. <g>

 

Well, it did NOT work. Trend Internet Security (PC-cillin) simply deletes AWC.exe because it us unable to "quarantine" it. I have the Iobit folder, as well as AWC.exe added to the (what I thought was) the 'ignore' list.

 

I'm going to UN-check File Monitor for the time being and get hold of Trend. If I get a solution before someone else in this forum does, then I will post it.

 

Thanks

[Doberman]

Good News

 

I just did another update from Trend Micro, and now I am able to download the ASC. I assume they have fixed their problem with their last update.

I realy like this product, it would be a shame if Trend Micro botched it all up.

Keep up the good work

[kfletch22]

Yeahhhh

 

Doberman is correct. I did an update and am now able to re-download the ASC program. I did an un-install and re-install just to be sure. Everything working fine now.

[budmeister]

Doberman is correct. I did an update and am now able to re-download the ASC program. I did an un-install and re-install just to be sure. Everything working fine now.

 

I also just got off an online chat with Trend Support. They asked for a HighJack This log file and could see that the problem had been rectified. I also scanned AWC.exe exclusively and "all's well that ends well" !

 

I must say that this forum has saved a lot of heartache in the last few hours!

 

Thanks folks.

[reaper727]

uhhh

 

yea i tried reinstalling again

and i cant seem to find this thing to put it as a exception ..

because its not installed!!!

it needs to be installed to be put as a exception

it keeps detecting it

i turn it off

but as soon as my antivirus goes on again it starts detecting it like crazy

and tons of temporary files and worms are located in c://program files/I0bit/Advanced System Care Pro 3

[enoskype]

why did everyone just get this yesterday?

online circulating viruses?

i got it 1 hour ago

and my comuter is being dumb about it

 

 

i dont think its a false positive

uninstallable on every computer i try

not allowed by trend micro

also norton, kaspersky, and some other anti virus stopped me from installing

this hupigon thing brought up 29 ".tmp" files into my quarantined infected files section.. is it a bug?

 

Hi reaper727,

 

I believe, now you think that it was a false positive and not a bug of ASC either.

 

Did you update your antivirus software as stated in the prior posts?

 

If you have done that, please read USAGE of IOBIT PRODUCTS thread, specifically post #2 and post #5. Install accordingly.

 

Cheers.

[work2832]

went to start up awc today n awc.exe was gone n i couldn't start up so i did wat kfletch22 did n everythin is back to great..no virus..thx kfletch22

[enoskype]

Doberman, kfletch22, budmeister, work2832,

 

Thanks for the feedback guys, very useful for the other users.

 

Cheers.

[Tim Xue]

Advanced SystemCare 3.2 was added on CNet at 24th Feb, and Trend Micro detected it yesterday!? Also, via VirusTotal you can see that only Trend Micro detected it, why?

[Timothy D. McNeil]

Yes it did I also had the same thing. also want to tell you that game booster works wonderful. thank you.

if you find out why? please e-mail me timothydmcnl@aol.com Thanks again.

[Tim Xue]

Trend Micro has fixed this false positive by updating their database. You can just update Trend's database to resolve this problem.

[waynes]

Working Again

 

Well, it seems AWC is working again, now that I have an updated virus definition from Trend Micro that has fixed the false positive issue.

 

But just to let you know, I was not able to create an exception in Trend Micro Client Security Agent. Furthermore, I don't have PC-Cillin Internet Security, so the instructions provided earlier in this thread do not apply.

 

I'd rather have a few false positives than a real virus on my user's computers though.

 

And it seems to me that, perhaps, iobit is trying to write code that is "unconventional", being that it was detected as a seriously false positive? Is iobit trying to do anything out of the ordinary with their code writing style that would cause this false positive, or should I change our Antivirus platform?

[solbjerg]

Hi wayne

Rather have a few false positives?

"I would rather not have a few false positives!"

This is a fault that rests in the company that "finds" the false positives, and have nothing to do with with the reality of the situation.

And this ought to make one aware that Anti-virus companies aren't infallible either!

Cheers

sollbjerg

 

Well, it seems AWC is working again, now that I have an updated virus definition from Trend Micro that has fixed the false positive issue.

 

But just to let you know, I was not able to create an exception in Trend Micro Client Security Agent. Furthermore, I don't have PC-Cillin Internet Security, so the instructions provided earlier in this thread do not apply.

 

I'd rather have a few false positives than a real virus on my user's computers though.

 

And it seems to me that, perhaps, iobit is trying to write code that is "unconventional", being that it was detected as a seriously false positive? Is iobit trying to do anything out of the ordinary with their code writing style that would cause this false positive, or should I change our Antivirus platform?

[Tim Xue]

Well, it seems AWC is working again, now that I have an updated virus definition from Trend Micro that has fixed the false positive issue.

 

But just to let you know, I was not able to create an exception in Trend Micro Client Security Agent. Furthermore, I don't have PC-Cillin Internet Security, so the instructions provided earlier in this thread do not apply.

 

I'd rather have a few false positives than a real virus on my user's computers though.

And it seems to me that, perhaps, iobit is trying to write code that is "unconventional", being that it was detected as a seriously false positive? Is iobit trying to do anything out of the ordinary with their code writing style that would cause this false positive, or should I change our Antivirus platform?

 

I don't agree with you, my friend. As I said, version 3.2 of Advanced SystemCare was added on CNet at 24th Feb. And then Trend detected the "unconventional code" at 2th Apr? Also, per the VirusTotal's result, there is not any other AV product detected ASC as virus.

 

I can only tell you that it's their mistake with pool technology. Also, a few false positive means when there is a real virus, you will never know whether it is a false positive or a real virus.

[minddoctor]

Can assure you that Trend Micro is known to give you false positive, as I am a beta tester for all antivirus, antispyware and most new programs that are not yet available to the general public. I can assure you that Advance System Care 3.20. pro is 100% clean. I run ESET NOD32 an Malwarebytes, and Superantispyware, and the only program that was removed, was Registry Fix, that I was testing. All three programs found embedded adware in Registry Fix. (Nothing was found in ASC).

 

When I was testing Trend Micro, I complained that their software showed far to many false/positives. (I guess they have done nothing to correct this problem).

[enoskype]

I run ESET NOD32 an Malwarebytes, and Superantispyware, and the only program that was removed, was Registry Fix, that I was testing. All three programs found embedded adware in Registry Fix. (Nothing was found in ASC).

 

Hi minddoctor,

 

Just not to cause misuderstanding to the others, I am giving your quote from another thread here to show that, Registry Fix you mention in post #45 here in this thread, is an other independent program and nothing to do with the registry fix function of ASC from IObit.

 

 

Important info., left out: I am not talking about the registry fix in ASC. I am talking about a registry fix software called ¨Registry Fix¨.

 

Please correct me if I am wrong.

 

Cheers.

[DCE]

AWC.exe corrupt file error??

 

I have been dealing with an AWC.exe corrupt file error for a short while and want to get it fixed. I am a Advanced System Care Pro user and have not had problems in the past.

 

I am trying to make sure this is not a virus. I have McAfee and have run it but not had it show any viruses.

Any help is appreciated if you have had this problem or how to fix it.

 

D'