Avast informs me that this false positive will be corrected in the next update. The Gods in the machine have otherwise, to date, been sending me non-afr work units.

In the interim, I have overcome the problem by:
* Excluding BOINC from scans
* Excluding the CPDN download servers from scans

I also temporarily suspended the anti-virus functions and retried the download. The file is now sitting on my computer. Whether it's allowed to run remains to be seen.

EDIT: I suspended everything else and tried starting the afr work unit. Avast decided to block it. Sadly, this was the third iteration of this work unit (hadam3p_afr_raey_2013_1_009440447), so it now won't be done. Miffed.

I have updated my preferences to avoid downloading any more until Avast gets this fixed.

I can confirm that we have checked this file, and our procedures to ensure that is virus free.
The file is reported by heuristic scanners as 'virus-like' which is inevitable because of the nature of BOINC.

I have spent quite some time contacting various antivirus vendors alerting them to this particular false positive.

Avast
Symantec
Norman
Cyren
DrWeb
TrendMicro

and the meta site:

https://www.virustotal.com/en-gb/file/07b01fccd043d22519a8cae4cc82c2dd38935463ab5776a63759ced3dbd45cf9/analysis/

I am not sure what else we can do.

Jonathan Miller

CPDN Sys-Admin

Cyren have confirmed that this is indeed a false positive, the file is not malicious.

Jonathan Miller
CPDN Sys-Admin

Hi,
I found for TrendMicro, that the web-reputation service is causing the problem.
The web-reputation service doesn't allow a download from the download share you are using for the boinc program files like "hadam3p_afr_7.22_windows_intelx86.exe".
The project program files are created, but only contain the info text from web-reputation service.

Will try to post the web-reputation message from file tonight.

---

Matthias

Hi,
I found for TrendMicro, that the web-reputation service is causing the problem.
The web-reputation service doesn't allow a download from the download share you are using for the boinc program files like "hadam3p_afr_7.22_windows_intelx86.exe".
The project program files are created, but only contain the info text from web-reputation service.

Will try to post the web-reputation message from file tonight.

I was having TrendMicro block a number of Climate models. I was able to check under threats what was blocked and then allowed for this to be excluded from now on, also sent of information to TrendMicro that these are false positives.

All now working OK.

Conan

---

I discovered this is not just happening to the hadam3p- files, but also to the wah2- files.

Norton removed the file "wah2_8.24_windows_intelx86.exe", telling me that it carried a heuristic virus.

---

It's the Norton program that's the problem.
See if you can find where/how to exclude all of the BOINC data section, which includes the cpdn files.