Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

A friend of mine works in a small company where no IT-guys are present. That's where I sometimes come in.

After someone opened a suspicious e-mail, one of the executables of a program they use got infected. F-secure quarantined the file after wich I removed it. I scanned the computer with several AV's and anti-malware packages, including a G-data linux boot up CD. All tests came out clean. I tried to restore the executable from the CD (both in windows and linux) after I scanned it -again- with different programs, but F-secure keeps putting the exe in quarantine.

The file is on serveral locations on the computer (i.e. in a folder that has a copy of the CD-ROM and in the folder where the program is installed to), and all of these copies come up in the f-secure scan as viruses. How is this possible? The executable never gave any problems before the e-mail, so I'm pretty sure the exe on the CD is clean. At first I thought it got triggered by the name of the file, but it got quarantined after I renamed it and tried to restore it as well.

Althoug I don't like to do this, but as I'm quite sure the executable isn't infected, I excluded it from the F-secure scans, so they can continue to use the program.

Does anyone have some tips? I'm kind of running out of idea's here.

Programs I used to scan the file with (all latest versiosn and virus definitions): - F-secure internet security - Ad-aware - Microsoft security essentials - Comodo Free Anti-virus - G-Data Anti-virus boot up CD (linux based)

share|improve this question
    
Can you upload it to virustotal? and what does F-Secure call the infection? –  Ja5087 Apr 6 '11 at 8:40
    
The Virus is called: Gen:Variant.Kazy.15902 I've uploaded it to Virustotal and the result was that 3 of 41 tests (7.3%) tagged the file as infected. Any ideas? –  VolrathTheFallen Apr 7 '11 at 15:57
    
Sorry this is not a topic i'm confident at. –  Ja5087 Apr 9 '11 at 12:37

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.