The latest update to Avast is telling me apmsgfwd.exe located in the C:\Program Files\DellTPad folder is a virus. I moved it to the chest and the “Last Changed Date” date in the chest is 3/22/08 1:32:04 AM. I do have the Alps touchpad drivers but I’ve had them for over a year now when I bought my laptop.
Before I moved the file to the chest, I restored my system to five days ago. Everything loaded fine as usual. No warnings. Only after Avast updates to this latest edition does it warn me on start up that a virus (ApMsgFwd.exe) has been found.
Is this a false positive? I’ve never had this happen before so I appreciate any advice you have.
Check the offending/suspect file at: VirusTotal - Multi engine on-line virus scanner and report the findings here the URL in the Address bar of the VT results page. You can’t do this with the file securely in the chest, you need to extract it to a temporary (not original) location first, see below.
Create a folder called Suspect in the C:\ drive, e.g. C:\Suspect. Now exclude that folder in the Standard Shield, Customize, Advanced, Add, type (or copy and paste) C:\Suspect* That will stop the standard shield scanning any file you put in that folder. You should now be able to export any file in the chest to this folder and upload it to VirusTotal without avast alerting.
Also, I should add that the page shows a July 20 date for the scan but I just scanned it a few minutes ago (July 21). When I tried to upload it, Virus Total reported that the file had already been scanned. I assume by someone else out there in the world because it wasn’t me.
Well the results show that no scanners including avast detect this, however the VPS version used in the upload that you did is a couple of days old. So it is possible that a recent VPS updae has incorrectly detected this file, a false positive.
The latest VPS is (current version 090721-0), so ensure you have the latest version and scan the file again within the chest. If it is still detected report the detection as a false positive, right click on the file in the chest - select email to Alwil Software. It will be uploaded (not actually emailed) to avast when the next avast auto (or manual) update is done.
If it is no longer detected - Restore it to its original location, periodically check it (scan it in the chest), there should still be a copy in the chest even though you restored it to the original location.
Wow, strange results then. When it happened, it only happened on boot. I was so surprised when I started up my system (I’m the only user) and I got those radiation-looking symbols with the guy shouting at me that the ApMsgFwd.exe file was a virus. Anyway…
Just checked and I do have 090721-0. Did a re-scan of the file in the chest and Avast gave me the
Scanning of selected files
Action was completed successfully!
I take it that means nothing was found and I can restore it.
Yes, that means nothing was found (signature modified/corrected in a VPS Update) as if avast still considered it infected it would have alerted. So you can restore it.