CPQSET.EXE false positive

Viruses and worms
1

I have sent this file in as a false positive. It started reporting after the last update together with other programs that are several years old and one not even used (earthlink setup.exe. The C:\Program Files\UPHClean\uphclean.exe false positive seems to have been fixed as of yesterday.

I have ran several other on line virus scans on this file with no errors returned. It is a HP\Compaq background program. I have had no success to be able to exclude the file from scans or even having it run in the sandbox which I find interesting. Anyhow, my XP system is current with all updates as is my AVAST free updates as of today.

I received an email stating thst this error was closed with no explanation but the files still report as a virus.

Any input welcome
thanks

2

upload suspicious file(s) to www.virustotal.com and test with 44 malware scanners
when you have the result, copy the url in the address bar and post it here for us to see

alternative
Jotti http://virusscan.jotti.org/en
VirSCAN http://virscan.org/
Metascan http://www.metascan-online.com/

3

here you go

http://www.virustotal.com/file-scan/report.html?id=876c932ba5c9732189ebeb85aa9a45f457f62b00a85827b803a1e8b508ba8e56-1316529231

4

UPDATE: I just retrieved the file from the original backup from 2005 and came up as an virus.

5

The VT report say First seen: 2008-05-01 15:38:38 Last seen : 2011-09-20 14:33:51

but no info in the sigcheck …is that not strange ?

sigcheck:
publisher…: n/a
copyright…: n/a
product…: n/a
description…: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments…: n/a
signers…: -
signing date.: -
verified…: Unsigned

Prevx File info
http://www.prevx.com/filenames/X2093733127530233878-X1/CPQSET.EXE.html

6

http://virusscan.jotti.org/en/scanresult/fb3f0638983c521ef4997116ca9603ea4266aaa1

Ran another, hope this helps.

7

have you run a quick scan with Malwarebytes for a second opinion ?

Malwarebytes Anti-Malware 1.51. http://filehippo.com/download_malwarebytes_anti_malware/
always update so you have the latest signatures before you scan
click on the remove selected button to quarantine anything found

if anything is found you may post the scan log here

8

Yes I use the lastest malwarebytes daily. Ran full scan last night with no errors.

9

Just ran malwarebytes on the file itself with Zero errors just to make double sure.

10

first seen in 2008 and avast detect it with a generic detection…i think it is clean

wait for next update and see if it is fixed

11

I’m sorry, wait for the next avast engine or definition database and you believe it is a false positive? Just want to make sure I’m reading you correctly.

thanks

12

Next signature update http://www.avast.com/en-no/virus-update-history

if you want, you can also upload it to Avira lab and see what they say about the file http://analysis.avira.com/samples/

13

Well there is no MD5 hash here for this background hardware related executable (driver)
: http://www.backgroundtask.eu/Systeemtaken/taakinfo/5970/Cpqset.exe/
considered a safe process here: http://www.processlibrary.com/directory/files/cpqset/25345/
also consider this info: http://www.neuber.com/taskmanager/process/cpqset.exe.html
found as FP before: http://www.lavasoftsupport.com/index.php?showtopic=30912

polonus

14

Yup, that’s pretty much what I found too. Hopefully the next update will correct the problem. Appreciate your looking into this.

Skip

15

I just downloaded 110920-1 from -0. It did not correct the problem but I am assuming my problem may have been too new for that update to catch. I also uploaded the file to avia as requested and they have yet to respond. For the time being I am excluding the file and associated restore point files from being scanned.

16

Testing results cont’ed

http://www.garyshood.com/virus/results.php?r=519f539e74d3c5376f4ffca3b96bd9ed

17

OK, avira finally reported the files clean. Avast corrected their side and it no longer reports as a virus, earthlink setup.exe still does( also a FP ) but the file is so old I just deleted it as it is not needed. After a week or so on attempting to fix a problem that did not exist I remain unclear why this happened to begin with. Thanks to everyone who attempted to help with this problem.