Avast linux reports Nutcracker Family virus on separate Windows 7 harddrive Help

Viruses and worms
1

Hi, I need help determining if this is a false positive, I downloaded Avast for Linux Ubuntu 11.10 yesterday and scanned my other hard drive which has Windows 7 and Norton Internet Security 2012 on it and it said I have an infection called Nutcracker family and its located in a path that leads to a Norton file. Can you help me please? The exact path is:

C:\ProgramData\Norton{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.1.3\QBackup{E853CDB0-6590-49C8-BD8C-136A2362504E}.qbi

P.S. To avoid any confusion I have two hard drives…One with Ubuntu 11.10 and Avast installed and the other Hard drive has Windows 7 with Norton Internet Security 2012, so I was On Ubuntu hard drive and scanned (from within Ubuntu OS)the other hard drive that has Windows 7

Thank you,
Tom Smith

2

upload suspicious file(s) to www.virustotal.com and test with 40+ malware scanners
when you have the result, copy the url in the address bar and post it here for us to see

alternative
Jotti http://virusscan.jotti.org/en
VirSCAN http://virscan.org/
Metascan http://www.metascan-online.com/

however detecting in a folder that belongs to Norton…maybe it is detecting a norton virus signature ?

3

Hello,
Thank you for the quick response and those links are very useful. I scanned it with all the links you gave me in the windows environment and they all say found nothing. Then I went into the Ubuntu OS and they all said nothing found except Avast, it came up again. this is the link:

http://virusscan.jotti.org/en/scanresult/14d9935089367a3a2d8ddbe32a98b8e1f5893d64/58a3e721e33a089da7a43e3044e5c4f5f39dd268

This is the Url when you click on Nutcracker Family in the scan:

http://v.virscan.org/Nutcracker%20family.html

4

I think you are right, because I found out it’s in the QBackup folder I think that is the Quarantine folder for Norton, and the letters are blue which I think it means it’s compressed and/or encrypted. So my question is it safe? or should I delete and also why is Avast the only one detecting this?

5

Funny thing though is when I go into my Norton Internet Security 2012 and click on recent history and then Quarantine files it shows nothing. Not even scanned history shows this Nutcracker Family or any malware for that matter.

6

Oh by the way here’s an attachment of a Image snipit of the file location

7

It appears to be a detection of one of Nortons definitions

8

Thanks to ALL of you and especially Pondus for pointing me in the right direction and me doing further poking around my system and finding out IT IS a Norton quarantine file. When I deleted ALL the history from Norton Internet Security 2012 it was gone. Thanks again

P.S. I really don’t mind Avast detecting that because it makes me feel much more secure that it detected it.