Issues, Workarounds & Localization

Exact same thing happening here.

Eve uninstaller is a known trojan;

It sits silently on your computer for a month or two, and when its activated it sends subliminal message suggesting you resubscribe.

Happened to me !

Same here. AVG just said it was a trojan. Obviously a false positive.

also got this bug/alarm. and also got avg antivirus.

calls its a trojan..but I dl it from ccp so...Guess its a false alarm.

Ran another scan and a new code is poping up as a threat. Same location Eve uninstaller / Repair. Trojan Horse Generic27.CHLB Whats the deal here

Co-sign

Same here....

This is most likely (I'm like 101 % sure on this) caused by the virus scanner's heuristic search. That is, applying "guessing" in determining harmful programs that might sit behind some unknown program. In this case it's a false positive; that means: don't worry, just ignore the warning.

Classic virus scanners will search for specific parts of code or identical files. Heuristics allow them to guess the behavior of a program (or whether it's harmful or harmless) based on parts of its code. Unfortunately both repair.exe and uninstall.exe use techniques that aren't that uncommon for such programs, but that are very common for trojans too (and in this case the scanner assumes they're infected with (or essentially are) that specific trojan.

I'm not familiar with AVG, but I'm sure if you disable the heuristic, the files in question will no longer be detected as potentially harmful or infected. AVG has a more or less famous history of false positives hitting essential system files where "cleaning" the infected files made the system unbootable.

Personally, I recommend Microsoft Security Essentials ( http://windows.microsoft.com/mse ) due to them being far less intrusive (you almost don't notice it running) and I'm essentially guaranteed no false positive will break something in my system. It's true, as such it might be less effective in detecting the very latest malware, but at the same time you just have to apply some common sense when browsing or downloading, which should keep you fine.

If you're unsure about a potential file, you can use services such as VirusTotal ( http://www.virustotal.com/ ) to get a "second opinion" through an overview showing the results of the most famous antivirus solutions. This is still no 100 % guarantee there won't be any custom built maleware (e.g. to steal your login credentials) inside, but this should help in case you receive official distributed files triggering potential false positives (like in this case).

Out of curiosity I did a test run on my current repair.exe:
https://www.virustotal.com/file/e907c9a692555a849132ee2729f8e5a8eac15206093cf6843ac0775fdae4a094/analysis/1334323181/
Their AVG didn't detect anything (which might be interesting). Are you sure your signtures are up to date?

Also, due to the file being signed, you're able to check to see if it has been compromised/modified (i.e. if it's indeed infected by something third party): Open the file's properties, go to the signatures tab, select the signature and click on "Details". The top part of the new window popping up will tell you, if this file has been modified since signing. If the signature is ok, the file is fine and unchanged.

Edit: Sorry, but had to edit the links... for whatever reason the forum won't accept them being clicky. :/