Hi,

AONE Software Ultra Video Joiner v. 4.1.0

Win XP SP2
AVG 8.5
Ad-Aware AE 8.0.3

Def 148.10 yielded no positives - updated to def 148.12 today and received 2 positives for Win32.Trojan.Obfuscated.

C:\Program Files\Ultra Video Joiner\Ultra Video Joiner.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Ultra Video Joiner\Ultra Video Joiner.lnk

SmartScan with and without heuristics option both resulted in positives. Attempt to open the program was blocked and listed in Process rules.

I "allowed once" to keep the program, but since one file is a link only, thought it might be a false positive. I've zipped both into Ultra_Video_Joiner.rar and attached.

Thanks for your help!

Hi visitor,

Thanks for your report. We will reinvestigate these files - if they are confirmed as false positives, they will be removed from detection.

Regards,

Andy
Lavasoft Malware Labs

Hi visitor,

This file Ultra Video Joiner.exe has been confirmed as a false positive and will be removed from the next definition file update. The Ultra Video Joiner.lnk was not listed in our detection database though - could I ask you to upload the log file of the scan that detected it for further investigation? Thanks.

Regards,

Andy
Lavasoft Malware Labs

Hi Andy,

Thanks for the quick response. I've attached the log with the false positive, but maybe no more work is necessary. I updated to defs 148.13 today (update blog says 148.14, but core.zip downloaded and imported 148.13). SmartScan yielded no malicious results. Maybe Ad-Aware followed the .lnk target to the .exe and reported both?

Hello Visitor

Yes the detection of the .lnk-file (shortcut) was caused by Ad-Aware detecting the original file (Ultra Video Joiner.exe). Also, the core.zip should now contain the latest definition (0148.0014).


Regards
LS Anders