A friend of mine works in a small company where no IT-guys are present. That's where I sometimes come in.
After someone opened a suspicious e-mail, one of the executables of a program they use got infected. F-secure quarantined the file after wich I removed it. I scanned the computer with several AV's and anti-malware packages, including a G-data linux boot up CD. All tests came out clean. I tried to restore the executable from the CD (both in windows and linux) after I scanned it -again- with different programs, but F-secure keeps putting the exe in quarantine.
The file is on serveral locations on the computer (i.e. in a folder that has a copy of the CD-ROM and in the folder where the program is installed to), and all of these copies come up in the f-secure scan as viruses. How is this possible? The executable never gave any problems before the e-mail, so I'm pretty sure the exe on the CD is clean. At first I thought it got triggered by the name of the file, but it got quarantined after I renamed it and tried to restore it as well.
Althoug I don't like to do this, but as I'm quite sure the executable isn't infected, I excluded it from the F-secure scans, so they can continue to use the program.
Does anyone have some tips? I'm kind of running out of idea's here.
Programs I used to scan the file with (all latest versiosn and virus definitions): - F-secure internet security - Ad-aware - Microsoft security essentials - Comodo Free Anti-virus - G-Data Anti-virus boot up CD (linux based)