Are reported suspicious files ignored on next scan?

Avast Free Antivirus / Premium Security
1

Hi,
I have some questions related to threats reported after a recent full system scan. Two files were reported as suspicious, threat level high. As far as I know, they have been on my computer for the last year or two, and they are many years older than that. (They are among a lot of files I copied from the computer I used previously, the files were not in the system folder on my current computer.)

Here are the files reported as suspicious, they pass the test at virustotal.com:

FROM_OLD_COMPUTER\DRIVERS\AUDIO\ADDON\TBCTRAY.EXE
Threat: Win32:Malware-gen
See virustotal scan here: https://www.virustotal.com/file/43bae3de0577370773bff95eaa3e21cb6fd6704f5169a06700f72ac4a5bc53c2/analysis/1329606048/

FROM_OLD_COMPUTER\I386\tbctray.exe
Threat: Win32:Malware-gen
See virustotal scan here:
https://www.virustotal.com/file/43bae3de0577370773bff95eaa3e21cb6fd6704f5169a06700f72ac4a5bc53c2/analysis/1329606714/

Question 1: Is it unusual for old files to suddenly trigger an Avast warning?

When I wanted to look closer at the scan log afterwards, I noticed that the files were not in the chest even though I thought I had taken the recommended action and moved them there. (It turned out I had misunderstood how to move them to the chest because the translated version of Avast is a bit unclear on this point. I have switched to the English version now.)

Question 2: Why did later scans not report the files as threats, when they were still there? Is it because Avast ignores files that it has warned about before, or had the files been found to be false positives? I scanned my computer again less than 24 hours after the first time the threats were reported.

Question 3: If reported files are ignored on later scans, is there a way to reset Avast so that they will be reported again?

Thanks in advance for your help.

2

It isn’t unusual as new signatures are added all of the time and other generic signatures are updated.

The Win32:Malware-Gen is a generic signature (the -gen at the end of the malware name), so that is trying to catch multiple variants of the same type of malware and is a fine balance between detecting a new variant and detecting something valid as infected.

Strange that avast doesn’t alert in the VT results you posted.

When something like this occurs (possible FP) people submit the sample to avast for analysis. If confirmed an FP avast are generally quick to resolve it.

Avast doesn’t ignore files in subsequent scans, so if not detected the above is the likely reason, a corrected virus signature. So you don’t have to reset anything.

3

Thanks. It could be that the false positiv was corrected, I did wait a couple of days before uploading the files to virustotal.com.

4

You’re welcome.

That is the most likely conclusion, given that you waited a couple of days before testing at VT.