Virus problem relating to HEM2 ? False positive ?

[Ryuuk3tsu]

Hye

I was just trying to review my hands, when i noticed the note windows was weird, i had not as many tabs as usual and i cannot write in the window.

http://ryuuk3tsu.free.fr//Poker/Problems/NoteProblem.jpg

When i tried to close this windows, i got the following error message from avast antivirus

http://ryuuk3tsu.free.fr//Poker/Problems/VirusProblem.jpg


This problem occurs as many time as i open note windows and i close it

What can i do to solve this, it's pretty annoying for session review :'(

[DrDunne]

I was going to start a thread about this myself. I sat down to play a session and received this while HM2 was opening. I didn't think much about HM2 being involved and it confused me because I wasn't doing anything on my computer at that time. Then I just opened the note-box and got the same alert again. I've had 5 alerts now and I'm a little concerned.

[Ryuuk3tsu]

Hye DrDunne

Did you update anything ? The only update i had was those form avast

[MartinBKK]

Hye DrDunne

Did you update anything ? The only update i had was those form avast

same here

[DrDunne]

Hye DrDunne

Did you update anything ? The only update i had was those form avast

haven't updated anything recently. havent updated anything from avast, but there was an update from HM2 the other day.... i skipped it tho lol

[siweq86]

i have the same problem and i'm using avast

[andrej82]

+1, avast reporting that csc.exe is infected and reporting abour 3 infected .dll files (always different filenames) every time i start up HM2.

[Ryuuk3tsu]

Glad to see i'm not the only one, seems the problem comes from HEM2/avast and not from a real infection

[Lunitis]

Hi.
Today opening HM2 avast blocked something but HM2 started anyway...
I go to replayer to take some notes and i see that my notes are bugged.
SO i added both "objects" reported (C:....mafju0lx.dll and c:....41zw...) and framework folder to exceptions, but i still have notes bugged after restarting.
You can see here...

109111

Did no HM2 or avast update (maybe was some automatic one).

[MartinBKK]

And no badges are showing for me. Is this something to do with it?

EDIT: Yes, it is. Disabling Avast brings badges back.

[cbarrado]

Same here! i reinstalled all of microsot.Net Framework and deleted everything and i got the same message.

I reported what I think is a false positive to Avast, i will keep you updated if they anwser me

[GeeKay]

+1 Identical for me. Using AVAST and getting this every time I open HEM.

[HM_user63]

I reported what I think is a false positive to Avast, i will keep you updated if they anwser me
I also sent those suspicious files to Avast: Maybe they will solve the problem faster if more persons report! :)

[JJumboJeTT]

Hi.
Today opening HM2 avast blocked something but HM2 started anyway...
I go to replayer to take some notes and i see that my notes are bugged.
SO i added both "objects" reported (C:....mafju0lx.dll and c:....41zw...) and framework folder to exceptions, but i still have notes bugged after restarting.
You can see here...

109111

Did no HM2 or avast update (maybe was some automatic one).

Same here:
http://shrani.si/f/U/mr/35RVn9Bb/hmavast.jpg

[Ryuuk3tsu]

Hye, i just sent those files to avast. Hope they'll be able to do something for this problem.
Now the problem occurs, when i launch HEM2 too :'(

[Lunitis]

Oh...it might be related with notecaddy. Normal notes show up, but not notecaddy notes. I can see the manual notes, but i cant edit the file...it will look that the image.

[udbrky]

They have been known to overblock.

1) Please make sure you are installing on an administrator account and running as an administrator.

2) Please turn off UAC.

3) You'll need to add:
- hmupdate.exe (only exists during update)
- holdemmanager.exe
- hudfuncapps.exe
- postgres and pg_ctl, your poker client .exe
- table ninja.exe
- notecaddy.business.dll and notecaddy.contents.dll from the modules folder in holdemmanager's program files folder (you might have to type in the names in some firewalls, they do not show)

to the exceptions list in your firewall and antivirus. ****

4) Make sure that windows is fully updated. Keep checking for updates until it says twice five minutes apart that there are no more updates available.

5) You need to make sure that this folder*,

8/7/Vista: C:\Users\username\AppData\Roaming\HoldemManager\

XP: C:\Documents and Settings\User_name\Application Data\HoldemManager

as well as c:\programfiles\holdemmanager2, c:\hm2archive, c:\hmarchive and your site's hand history folder are each not read only** and that all permissions are set to full for your user name. ***

* You will need to show hidden files. See this tutorial for showing system and hidden files:

http://hm2faq.holdemmanager.com/questions/832/How+are+Hidden+Files+Viewed+in+Windows%3F+

See the location here for win 7:

http://www.udbrky.com/hmsupport/configfile.PNG

See the location here for win xp:

http://www.udbrky.com/hmsupport/configfile.PNG

** You will need to right click the folder, open properties. At the bottom in Attributes, uncheck the Read-Only. The folder will continue showing read only after that, this is an issue in Windows

*** This is in Properties as well, in Security.

****Please see this guide for Windows Firewall:

http://hm2faq.holdemmanager.com/questions/1052/Windows+Firewall+%7B47%7D+Defender+Problems

Please see this FAQ for setting permissions and unchecking read only:

http://hm2faq.holdemmanager.com/questions/2561/Set+Correct+Permissions+on+files+and+folders+HM2+u se

[Ryuuk3tsu]

Hye udbrky

I did all you told me to do, but the problem is still here :(

[Aus_Husky610]

I followed the steps but still get the problem. If I stop the file System shield in Avast it works fine

[Ryuuk3tsu]

I followed the steps but still get the problem. If I stop the file System shield in Avast it works fine

When disabled the protection, doesn't have the error message anymore.
But how can we fix this without disabling the protection ?

[danfiu]

Any update?

[Sarek]

There are no viruses in HM. False alert.
I'd recommend sending this to Avast support - they should make changes in their database.

[cbarrado]

but the virus alert is not about HM, pop ups when it opens microsoft.NET Framework, file csc.exe

[Sarek]

These processes are initiated by HM2

[cbarrado]

so why don´t you say we should add csc.exe to exclusion list on Avast? Is that enough?

[Nisselioni]

I still have this issue, any woork around?

[DogNamedBluff]

I still have this issue, any woork around?

Have you tried disabling Avast?

[Nisselioni]

yeah thats what ive been doin and it work but was wondering if there was a more permanent fix for this. dont realy wanna sit without any anti virus program.

[DrDunne]

yeah thats what ive been doin and it work but was wondering if there was a more permanent fix for this. dont realy wanna sit without any anti virus program.
+1

this has never happened before i can't understand why it should happen now. i didn't even update HM recently.

[olavfo]

As a temporary fix, disable the Avast File System Shield, start HEM, then turn it back on. Don't close HEM between sessions and you won't have to deal with the problem often. I played using this fix yesterday and everything seemed to work as usual.

[Ryuuk3tsu]

As a temporary fix, disable the Avast File System Shield, start HEM, then turn it back on. Don't close HEM between sessions and you won't have to deal with the problem often. I played using this fix yesterday and everything seemed to work as usual.

You could write note using this "fix" ? This couldn't work for me :( . So i changed my antivirus to g data

[olavfo]

You could write note using this "fix" ? This couldn't work for me :( . So i changed my antivirus to g data
I could write notes, and didn't experience any other errors. I use Windows 7 and the pay-version of Avast.

[Orb]

This happens to me as well.
any fix anticipated to come out in the near future?

[udbrky]

We cannot stop Avast from overblocking. We've sent reports to them regarding this.

[udbrky]

Nice guess! :D Fortunately the Avast update today fixed the false positive problem; after that I created a new database (the old one was set up with this false positve garbage).
And of course I downloaded the latest NC update.

Finally NC basic works fine again: Thank your for your help!


It looks like Avast has released an update for this.

[Ryuuk3tsu]

Thanks for the information