Avira says fsaddle.dll is malware

Question

Avira AntiVir Premium Ver 8.1.0.367
Firefox 2.0.0.16
Fireshot v 0.59

While Firefox doing auto update of Fireshot Add On (Sept 4-08), Avira blipped and automatically quarantined _fsaddle.dll_ from the library subfolder of the Fireshot addon folder in Profile Extension folder. Says malware [heuristic] in report.

So this is not in Fireshot folder (double checked!) but a few tests show Fireshot works anyway, at least for simple things I use for like select, crop and save. Still, a bit uncomfortable to have happen as I very rarely get Avira catching something as otherwise do take a lot of precautions what I do and so on, and being non technical, it is hard to understand why this happens only for Fireshot.

Accepted Answer

You mean fsaddin.dll, of course.

Anyway, this is strange to hear. FireShot used to have a GUID marked as malware in the past, but now it should be OK with it.

P.S. It should be working OK in Firefox. The problem regards only FireShot for Internet Explorer.

P.S2. By the way, can you do me a favour? I'd like to know whether it's OK with standalone installer of FireShot for Internet Explorer. Could you download it and install at your PC with further checking by Avira?

The link is: screenshot-program.com/fireshot_ie_install.zip
__________________

FireShot Pro Pro Full Webpage Screenshots will be moving to a subscription model soon!
There's a last chance to purchase a Lifetime License and get a 33% discount! - https://getfireshot.com/buy.php

Answer

Text below is the response from Avira:

We received the following archive files:
File ID    Filename Size (Byte) Result
25210065    fireshot_63.xpi 870.83 KB OK

A listing of files contained inside archives alongside their results can be found below:
File ID    Filename Size (Byte) Result
25210212    fsaddin.dll    48 KB    FALSE POSITIVE

Please find a detailed report concerning each individual sample below:
Filename Result
fsaddin.dll    FALSE POSITIVE

The file 'fsaddin.dll' has been determined to be 'FALSE POSITIVE'. In particular this means that this file is not malicious but a false alarm. Detection will be removed from our virus definition file (VDF) with one of the next updates.
__________________

FireShot Pro Pro Full Webpage Screenshots will be moving to a subscription model soon!
There's a last chance to purchase a Lifetime License and get a 33% discount! - https://getfireshot.com/buy.php

Answer

What is 'Trend' ?

Posted: 05 Sep 2008 00:31
	Registered User Currently Offline	Posts: 2 Join Date: Sep 2008
Avira AntiVir Premium Ver 8.1.0.367 Firefox 2.0.0.16 Fireshot v 0.59 While Firefox doing auto update of Fireshot Add On (Sept 4-08), Avira blipped and automatically quarantined _fsaddle.dll_ from the library subfolder of the Fireshot addon folder in Profile Extension folder. Says malware [heuristic] in report. So this is not in Fireshot folder (double checked!) but a few tests show Fireshot works anyway, at least for simple things I use for like select, crop and save. Still, a bit uncomfortable to have happen as I very rarely get Avira catching something as otherwise do take a lot of precautions what I do and so on, and being non technical, it is hard to understand why this happens only for Fireshot.

Posted: 05 Sep 2008 08:19
	Administrator Currently Offline	Posts: 4268 Join Date: Jan 2007
You mean fsaddin.dll, of course. Anyway, this is strange to hear. FireShot used to have a GUID marked as malware in the past, but now it should be OK with it. P.S. It should be working OK in Firefox. The problem regards only FireShot for Internet Explorer. P.S2. By the way, can you do me a favour? I'd like to know whether it's OK with standalone installer of FireShot for Internet Explorer. Could you download it and install at your PC with further checking by Avira? The link is: screenshot-program.com/fireshot_ie_install.zip __________________ FireShot Pro Pro Full Webpage Screenshots will be moving to a subscription model soon! There's a last chance to purchase a Lifetime License and get a 33% discount! - https://getfireshot.com/buy.php

Posted: 05 Sep 2008 22:21
	Registered User Currently Offline	Posts: 2 Join Date: Sep 2008
Yes, typo. DL IE install, NO Avira warning with it. See that Avira quart this fsaddin.dll in August also. Glad to know nothing to bother for me. Appreciate you take time to answer. BTW This Brilliant programming, congratulations, and thank you for sharing.

Posted: 06 Sep 2008 08:25
	Administrator Currently Offline	Posts: 4268 Join Date: Jan 2007
Thanks. __________________ FireShot Pro Pro Full Webpage Screenshots will be moving to a subscription model soon! There's a last chance to purchase a Lifetime License and get a 33% discount! - https://getfireshot.com/buy.php

Posted: 12 Dec 2008 18:06 Last Edited By: Azreael
	Registered User Currently Offline	Posts: 1 Join Date: Dec 2008
Same virus message by Avira Personal Free Edition with the latest update (FF3).

Posted: 14 Dec 2008 07:08 Last Edited By: JK
	Administrator Currently Offline	Posts: 4268 Join Date: Jan 2007
Text below is the response from Avira: We received the following archive files: File ID Filename Size (Byte) Result 25210065 fireshot_63.xpi 870.83 KB OK A listing of files contained inside archives alongside their results can be found below: File ID Filename Size (Byte) Result 25210212 fsaddin.dll 48 KB FALSE POSITIVE Please find a detailed report concerning each individual sample below: Filename Result fsaddin.dll FALSE POSITIVE The file 'fsaddin.dll' has been determined to be 'FALSE POSITIVE'. In particular this means that this file is not malicious but a false alarm. Detection will be removed from our virus definition file (VDF) with one of the next updates. __________________ FireShot Pro Pro Full Webpage Screenshots will be moving to a subscription model soon! There's a last chance to purchase a Lifetime License and get a 33% discount! - https://getfireshot.com/buy.php

Posted: 26 Feb 2009 16:34
	Registered User Currently Offline	Posts: 1 Join Date: Feb 2009
the IE version that comes down off the web site still trips Trend. if you could tell me what to look for i would be happy to provide the codes. but it is premumably the false positive.

Posted: 27 Feb 2009 08:26
	Administrator Currently Offline	Posts: 4268 Join Date: Jan 2007
What is "Trend" ? __________________ FireShot Pro Pro Full Webpage Screenshots will be moving to a subscription model soon! There's a last chance to purchase a Lifetime License and get a 33% discount! - https://getfireshot.com/buy.php

Recent topics	Replies	Views	Last Poster
Print of flash content results in Floating point division by zero	6	5345
So need a Mac version!!!!	13	5357
double input in Chinese	3	4240
Translate to other language	3	4501
leak memory	1	4170
save to existing read-only file	0	3917
Problems with Fireshot for IE and IE7 on Vista	1	5431
Dual Video web capture Non-functional	3	2428
Email Information	1	2131
Hotkey not working in IE	1	4885