You are not logged in.

Friday, April 25th 2014, 9:34am

Dear visitor, welcome to Avira Support Forum. If this is your first visit here, please read the Help. It explains in detail how this page works. To use all features of this page, you should consider registering. Please use the registration form, to register here or read more information about the registration process. If you are already registered, please login here.

  • "gad1" started this thread

Date of registration:
Jan 19th 2012

Version:
Avira Free Antivirus

Operating System:
XP SP3

  • Send private message

1

Thursday, January 19th 2012, 1:35pm

Exp/cve-2011-3402

Hi,

I have the exact same problem as described in "[Solved] Repeat message on re-boot" (threadID=138847) and I executed all of the tests which were suggested by Marco and nothing was found.

The only difference is that I got those repeating messages even after I deactivated the Microsoft patch (which caused the false positive warning for the guy who posted the original question). How can I confirm that it's also a false positive in my case as well?

Thanks!

marfabilis

Moderator

Date of registration:
May 14th 2010

Version:
Avira Free Antivirus
Avira Antivirus Suite
Avira Internet Security Suite
Avira Internet Security

Operating System:
System of a Down

  • Send private message

2

Thursday, January 19th 2012, 1:48pm

Hi gad1,

This detection under this file is probably a false positive detection. There is a technical reason for this, but let first confirm this hypothesis.
Please go to Start > Run > type cmd then press Enter > type the following into the Command Prompt window: copy C:\WINDOWS\Fonts\gulim.ttc C: > Press Enter > The true-type font gulim.ttc will be copied to the C:\ . Probably the file will not be detected as EXP/CVE-2011-3402 there (please perform a manual scan on the C:\gulim.ttc file).

Tell me the results.

Marco
| :: RU | EN | PT-BR | ZH-CN | ZH-TW ::

  • "gad1" started this thread

Date of registration:
Jan 19th 2012

Version:
Avira Free Antivirus

Operating System:
XP SP3

  • Send private message

3

Friday, January 20th 2012, 7:52am

Hi,

I scanned the file as you suggested and no virus was found.

Does it mean that this is false positive?

Thanks!

marfabilis

Moderator

Date of registration:
May 14th 2010

Version:
Avira Free Antivirus
Avira Antivirus Suite
Avira Internet Security Suite
Avira Internet Security

Operating System:
System of a Down

  • Send private message

4

Friday, January 20th 2012, 9:15am

Hi gad1,

Then, it's a false positive as I had suspected. Due to some complaints from similar cases that were analyzed before, Avira is investigating this "bug".
This is a technical issue that I'm not allowed to comment here. Meanwhile, you can just add two exceptions in your Realtime Protection module:

C:\WINDOWS\Fonts\gulim.ttc
C:\WINDOWS\Fonts\batang.ttc


There is no need to add these exceptions to the System Scanner module, only to the Realtime Protection module, right?
Adding these two exceptions in the Realtime Protection module, the issue should not happen again.

I'll try to keep you posted about this bug when it's fixed by some product update :)
| :: RU | EN | PT-BR | ZH-CN | ZH-TW ::

  • "gad1" started this thread

Date of registration:
Jan 19th 2012

Version:
Avira Free Antivirus

Operating System:
XP SP3

  • Send private message

5

Friday, January 20th 2012, 2:07pm

Thank you very much for your help!

marfabilis

Moderator

Date of registration:
May 14th 2010

Version:
Avira Free Antivirus
Avira Antivirus Suite
Avira Internet Security Suite
Avira Internet Security

Operating System:
System of a Down

  • Send private message

6

Friday, January 20th 2012, 2:22pm

Hi gad1,

You're most welcome ^^

Marco
| :: RU | EN | PT-BR | ZH-CN | ZH-TW ::