AVG - False positive

[Wocka]

Last night my wife turned on her laptop and AVG popped up a virus detection message.
I believe I'm still on the first release after the beta, so nothing has changed for a while in theinstallation of Veeam or AVG.

Threat: Virus found Win32/Hedo
Object Name: C:\Program Files\Veeam\Endpoint Backup\Veeam.Backup.Core.dll

I allowed AVG to clean the file and reboot the laptop. I didn't try and run Endpoint Backup after this, so I dont know if it has removed a critical file.
Looking at one of my Windows servers here in the office, this file does exist.

Does anyone know if this was a false positive or could there be something to this?

[Ralph Schmidt]

Same situation here on my Windows 7 x64 machine running veeam Endpoint Backup version 1.1.2.119.
AVG AntiVirus FREE version 2016.0.7227, virus DB version 4477/11061 (Wednesday, 25. November 2015, 03:02).

I'm pretty sure, this is a false positive - hopefully

[Dima P.]

Hi folks,

Is it possible to open a support case with AVG to let them know that it’s happening? If you have any screenshot of this false detection please sent it to me, I’ll try to contact the AVG team from my side as well.

[Jason.Lochinger]

Here is a screen shot of the false detection.

[Dima P.]

Thanks for sharing. I’ve submitted the false positive detection case with AG – let’s see how it goes.

[FraFek]

I keep having the same problem here. AVG won't let me run Veeam. Also a reinstall doesn't work
Win32/Hedo

AVG also finds 'the virus' in the newly downloaded .zip-file

[Vitaliy S.]

Hi Frank, please follow this KB to resolve your issue, while Dima is discussing it with AVG team.

[Dima P.]

FraFek,

If it’s possible please open a case with AVG. I am working on false positive submission but more cases from end users they get – faster whitelisting happends. Thank you in advance.

[ddayton]

I am running the latest AVG Free Edition on my home laptop with Windows 8.1 (64-bit) and installed EPB about a month ago (1.1.2.119). I had no reports of a virus from AVG and the laptop continues to run the backup schedule night after night.

[Dima P.]

Thanks for the heads up - glad to hear it! All the "detected" files were passed to the AVG team. I will update this thread once I hear back anything.

[Dima P.]

Here is a response, so make sure you are up-to-date!

The detection of this file by AVG is incorrect, and we can confirm that the file is not infected. The detection will be removed from an upcoming AVG update.

Please make sure that your AVG is updated with the latest virus database:

1. Open AVG.
2. Click the button Update now, or Protection is up-to-date to check for updates.
3. Once a new virus update is downloaded, AVG will not detect the file any more.

[Gostev]

Nice! Some antivirus vendors are more responsive than other

[sibinsam]

I updated AVG antivirus with latest definition but still getting virus alert.

[Dima P.]

Hi sibinsam,

Can you provide a screenshot please?

[sibinsam]

Please find screenshot below

[Dima P.]

Hi,

Thanks. Can you resize the AVG window to show the exact file with extension – I need the file name to submit the false positive request.

[sibinsam]

Dear Dima,

Sorry for the late reply. The full path of the file is "C:\Program Files\Veeam\EndPoint Backup\Veeam.Backup.Core.dll"

[Dima P.]

Thanks for yor help - I'll contact AVG!

[Dima P.]

False positive report has been submitted – awaiting for the response from AVG team. Thanks for your help.

[jhughes88]

Wondering if you ever got an answer from AVG on this issue? I am having an issue now with AVG Cloud Care that is hanging the entire system without reporting any virus detections.
Thanks,
J

[Dima P.]

Hi John,

Yes - AVG team reported that excluded our components from their database. Can you open a case with AVG from your end, since they may need to check the app logs.

[digitlman]

Just upgraded from 1.3 to 1.5, and now AVG says that Veeam.Backup.Core.dll has the Win32/Hedo virus.

I am sure this is AVG being dumb with a false postive...

[Mike Resseler]

Hi DigitIman,

Thanks for the heads up! I will pass it to our teams

Cheers

Mike

[Dima P.]

Hi digitlman,

Thanks. It seems that I need to submit a whitelist request again. Can you share a screenshot of your AVR screen, so I could add it to the AVG false positive request? Thanks in advance.

[digitlman]

http://s14.postimg.org/445yq7c35/Capture.png

[Dima P.]

False positive report has been submitted. Thanks digitlman!

[Ralph Schmidt]

... and again:

After updating Backup & Replication V9.0 (free) to Update 1 (Version 9.0.0.1491),
and bringing up the veeam services, AVG starts blaming:
C:\Program Files\Veeam\Backup and Replication\Backup Catalog\
Veeam.Backup.CatalogDataService.exe
to be a virus.

AVG AntiVirus Free Edition
Versionsnummer: 16.61.7539
AVG Framework Version: 1.73.2.7662
AVG Setup Version: 1.73.2.7513

Version der Virusdatenbank: 4563/12121 (28.04.2016, 08:07)

Please have AVG look into that again.

[Dima P.]

Thanks Ralph.

I’ll let VBR team know and submit a false positive for v9 Update 1 Veeam.Backup.CatalogDataService.exe file.

P.S. Reported to AVG team. Thanks again.