A0010588.exe - Is this a false positive?

Viruses and worms
1

I ran a scan of all three of my hard drives using Avast Pro on it’s highest sensitively settings.

The log at the end usually is filled with “False Positives” that I know for a fact are NOT harmful files.

However, I did notice two entries for my M:\ and N:\ drives I use for storage. It says the following files are infected:

M:\System Volume Information.…\A0010588.exe
N:\System Volume Information.…\A0009054.exe

I have un-hidden those folders but access is denied. Should I be alarmed by these or are they two false positives?

Thanks! :wink:

2

System Volume Information is the system restore folders, blocked by Windows, you can only handle these files (send to Chest) if you run avast at boot time.
If you disable system restore and enable again, you’ll delete all old restore points, including the possible infected ones.

3

You don’t say what the file names, locations, malware names are of these files, nor why you are so sure they are false positives.

You could also check the offending/suspect file at: VirusTotal - Multi engine on-line virus scanner and report the findings here the URL in the Address bar of the VT results page. You can’t do this with the file securely in the chest, you need to extract it to a temporary (not original) location first, see below.

Create a folder called Suspect in the C:\ drive, e.g. C:\Suspect. Now exclude that folder in the Standard Shield, Customize, Advanced, Add, type (or copy and paste) C:\Suspect* That will stop the standard shield scanning any file you put in that folder. You should now be able to export any file in the chest to this folder and upload it to VirusTotal without avast alerting.

If it is indeed a false positive, see http://forum.avast.com/index.php?topic=34950.msg293451#msg293451, how to report it to avast! and what to do to exclude them until the problem is corrected.