How does OA add files/process/ to trusted?

Based on its name or what?

Today Avira found "the file Txplatform.exe is the TR/Dlr.Hupigon.egy Trojan"

While in OA,I see it was auto-trusted.

 

Based on whitelist and digital signature issuer. What was the file ?

 

txplatform.exe.A common file in IM QQ.

Today,I sent the sample to Avira.The AV kept popping up about the detection when I tried to send the file.I kept clicking ignore.

But the result is so confusing:

Thank you for your submission. Below you can see the current status of the uploaded files.

A listing of files alongside their results can be found below:
File ID Filename Size (Byte) Result
25162815 TXPlatform.exe 149.31 KB


Please find a detailed report concerning each individual sample below:
Filename Result
TXPlatform.exe CLEAN

The file 'TXPlatform.exe' has been determined to be 'CLEAN'. Our analysts did not discovered any malicious content.
Please note that you will receive an email which will contain the results shown above. In case the final outcome of the analysis is not yet finished for all files the notification will be sent once ready.

Ain't it ridiculous?

 

Looks like FP. I have no other ideas

 

Their online scan engine doesn't use the same one of my up-to-date Avira free?

I thought if it was a FP,they would tell me only after a deep analysis.

You just don't know.These days I installed lot of stuff.Avira pops up too often for me.
I heard this year has much more new viruses than the past.And the day 3 days before Thanksgiving is the VIRUSDAY.So I'm kinda paranoid.

I scan my pc using AV,mbam,sas,F-secure anti-rootkit almost twice a day each!Nothing special could be found though.

 

Just a note for you. Avira is a good Av with the flaw that it tends to find too many FP's. You need to ensure that your Avira settings put "hits" into quarantine NOT delete as it is possible to delete a critical file.


As already mentioned OA uses a white list to id safe files which is a very good concept. But please note this is a HIPS type scan NOT a virus scan so OA and Avira are NOT the same type of security tool at all!

If you worry as much as you seem to, users can use web based AV scans from Kav and Bitdefender an some others to hunt for parasites. In this way you don't have to fill up your PC with all the software.

Just some thoughts.