0

A friend of mine works in a small company where no IT-guys are present. That's where I sometimes come in.

After someone opened a suspicious e-mail, one of the executables of a program they use got infected. F-secure quarantined the file after wich I removed it. I scanned the computer with several AV's and anti-malware packages, including a G-data linux boot up CD. All tests came out clean. I tried to restore the executable from the CD (both in windows and linux) after I scanned it -again- with different programs, but F-secure keeps putting the exe in quarantine.

The file is on serveral locations on the computer (i.e. in a folder that has a copy of the CD-ROM and in the folder where the program is installed to), and all of these copies come up in the f-secure scan as viruses. How is this possible? The executable never gave any problems before the e-mail, so I'm pretty sure the exe on the CD is clean. At first I thought it got triggered by the name of the file, but it got quarantined after I renamed it and tried to restore it as well.

Althoug I don't like to do this, but as I'm quite sure the executable isn't infected, I excluded it from the F-secure scans, so they can continue to use the program.

Does anyone have some tips? I'm kind of running out of idea's here.

Programs I used to scan the file with (all latest versiosn and virus definitions): - F-secure internet security - Ad-aware - Microsoft security essentials - Comodo Free Anti-virus - G-Data Anti-virus boot up CD (linux based)

3
  • Can you upload it to virustotal? and what does F-Secure call the infection?
    – Ja5087
    Apr 6, 2011 at 8:40
  • The Virus is called: Gen:Variant.Kazy.15902 I've uploaded it to Virustotal and the result was that 3 of 41 tests (7.3%) tagged the file as infected. Any ideas? Apr 7, 2011 at 15:57
  • Sorry this is not a topic i'm confident at.
    – Ja5087
    Apr 9, 2011 at 12:37

0

You must log in to answer this question.

Browse other questions tagged .