My next problem..

[Immortalis]

Downloaded Bit Che from the home page link, installed it and AVG reports the following...


"C:\Documents and Settings\Immortalis\Application Data\Convivea\Bit_Che\scripts\special.exe"                 ;"Runtime packed fsg"

I understand what it is, my question is... is this really a false positive or should I be worried? Should special.exe even exist in the scripts dir?

I did read the post about Anti Virus software, but that seems to deal more with Norton and Bit_Che.exe.

[Bovski]

special.exe is needed to log into some sites if you just use public sites you don't technically need it.

It's basically a webbrowser that captures the cookies for bit che.

Yes it belongs in the scripts directory.

I'm, not convinced its packed with fsg(Fast Small Good) but if you check out virus totals results of it then you will see all the major Virus checkers think its good.

http://www.virustotal.com/analisis/ab62b9b8b8f21379dce5ce0bbd930af7

[Immortalis]

Ok... thank you again very much!

[arjays]

I contacted AVG, and their responses were, at best, "scripted" (and practically useless).

Whether or not "SPECIAL.EXE" was/is actually "packed" by FSG is effectively immaterial.  The key point is that AVG thinks it is, and "flags" it, accordingly.

The "thing" is that AVG doesn't currently have the capability to "decompress" an FSG-packed module, so it can't "scan" it, so... it "flags" it, and puts the ball in "our court"...

The bottom line is that FSG-packed s/w are "suspect", in that they MAY be (or contain) malware... or not.  In the case of THIS "special.exe", the correct seems to be "not".  At least, one hopes....

FWIW, I found the following post on CNET, which explains "packing" quite well.

runtime packed fsg
by ManicWaldo - 5/10/09 3:03 AM In reply to: How dangerous is "runtime packed fsg" by auto78900
"Runtime Packed FSG" is not dangerous at all, not in any shape, manner or form. It's a "signature" that a particular program was used in making the file. It's a program designed to "pack" a program (.exe, etc) into a smaller size. FSG = Fast Small Good.

Now why does it show up in AV software?

Because malicious code writers use it frequently to:

1. pack their virus/malware executable files
2. make it harder for AV software to unpack the file and look for malicious code

It was used in legitimate programs also, but not much anymore because there are new and better packers available. And some not so legitimate, such as key generators made for software theft.

So what the Anti-Virus program is saying, "I don't know for sure if this is anything bad, but it was packed with a program that is often used to pack virii. So use at your own risk."

Since "runtime packed fsg" is not malware or a virus or anything bad in and of itself, you won't find much clear information about it. All the AV software is identifying is the fact that a "packer" program called "FSG" was used.

Here's an example of one of the latest greatest packers in legitimate use:

PECompact

PECompact compresses Windows modules (EXE, DLL, SCR, etc..) substantially, while leaving them able to be run just as before. At runtime, compressed modules are rapidly decompressed in memory. Smaller (<50%) size usually means quicker load time. PECompact generally compresses files much smaller than if they had been compressed by modern data compression software such as RAR.

[chip!]

If AVG wants to *flag* the file because its packed with a packer, then usually they just need to be contacted and they will add the file's signature to their safe-list. 

Yet, it should be noted as well, that almost all major Antivirus products can successfully handle FSG packed files. I am surprised if AVG still can not, because normally that is a decent security software. Of course, this doesnt really matter, since its as equally easy to add the file to your antivirus "ignore" list, should your antivirus company be stubborn about flagging packed files.

and of course, as always, Bit Che is 100% virus free

[andy who]

If AVG wants to *flag* the file because its packed with a packer, then usually they just need to be contacted and they will add the file's signature to their safe-list. 

Yet, it should be noted as well, that almost all major Antivirus products can successfully handle FSG packed files. I am surprised if AVG still can not, because normally that is a decent security software. Of course, this doesnt really matter, since its as equally easy to add the file to your antivirus "ignore" list, should your antivirus company be stubborn about flagging packed files.

and of course, as always, Bit Che is 100% virus free

cheers