AVG reporting downloader in 2007 SDK

[pwortas]

As of my last update to AVG Free, it is reporting the malware Downloader.Swizzor in the following executables from the 2007 SDK package.

tools\Windows\x86_64\XP\wiretap_client_tool.exe
tools\Windows\x86_64\XP\wiretap_get_children.exe
tools\Windows\x86_64\XP\wiretap_rw_frame.exe

This is consistent across all instances of the executables and is also detected in the source file WireTapAPI-SW20070-1019.zip.

I was unable to find a location to re-download the 2007 SDK to test it. Since this just came up, I would assume it's mistakenly fingerprinting the above executables. The 2008 SDK (WireTapAPI-SW2008-1080.zip) is not affected.

Does anyone else still use/have the 2007 SDK to test/confirm this?

[Anonymous]

Hi,

Thanks for reporting this. We had a look at the older version of the ZIP file you cited with AVG and managed to reproduce the issue only with the build of the SDK you cited. No other builds seemed affected.

We were not able to find the virus with any other commercial virus scanner even with the most current definition files. After some research, it seems that AVG has had problems in the past with false alarms specific to the Downloader.Swizzor virus.

Regardless, our IT department is giving this their full attention just to be safe, and I would be surprised if it turns out to be a real threat. The virus is also quite easy to remove.

Sincerely,

Dan Labute
Autodesk M&E

[davher]

I think you guys should check out http://www.opswat.com/ there are 2 or 3 products that may be a match. I think that OESIS Framework at http://www.opswat.com/products/oesis-framework provides a single interface to many antivirus and AVG is in that list. Another option is, I think, Metascan at http://www.opswat.com/products/metascan which is more for ISV.
I also found that AVG is certified by OPSWAT at http://www.opswat.com/certified.

I hope this helps.
Regards,