False Alarm on Acer 'installnet.exe'?

Avast Free Antivirus / Premium Security
1

On one of my XP/SP3 machines, avast 4.8 Home is reporting that c:\Acer\Empowered Technology\installnet.exe is Win32:Tojan-gen {Other} malware. VPS version is 080822-0, 08/22/2008.

I was unable to upload the file to virustotal.com - even when I selected ‘No action’ in avast, it appears to have locked the file. I moved the file to another PC and uploaded it - virustotal.com reports 1/36 scanners found a virus:
Avast 4.8.1195.0 2008.08.22 Win32:Trojan-gen {Other}

I have no reason to believe that this file has been changed since the PC was purchased from Acer. Could this be a false alarm?

Thanks, Norbert

2

norbert
go to virus total website and upload the file
report back
you can also send it to avast- did you see a stickie on FP’s?

3

wyrmider, I reported particular Virus Total results above. Full results below.

Sent ZIPed/encrypted copy to virus@avast.com.

In terms of a sticky post, if you are referring to http://forum.avast.com/index.php?topic=7779.msg62586#msg62586, it does not show at the beginning of the forum.

File installnet.exe received on 08.23.2008 21:43:56 (CET)
Current status: Loading … queued waiting scanning finished NOT FOUND STOPPED
Result: 1/36 (2.78%)

Antivirus Version Last Update Result
AhnLab-V3 2008.8.21.0 2008.08.22 -
AntiVir 7.8.1.23 2008.08.23 -
Authentium 5.1.0.4 2008.08.23 -
Avast 4.8.1195.0 2008.08.23 Win32:Trojan-gen {Other}
AVG 8.0.0.161 2008.08.23 -
BitDefender 7.2 2008.08.23 -
CAT-QuickHeal 9.50 2008.08.22 -
ClamAV 0.93.1 2008.08.23 -
DrWeb 4.44.0.09170 2008.08.23 -
eSafe 7.0.17.0 2008.08.21 -
eTrust-Vet 31.6.6040 2008.08.22 -
Ewido 4.0 2008.08.23 -
F-Prot 4.4.4.56 2008.08.23 -
F-Secure 7.60.13501.0 2008.08.23 -
Fortinet 3.14.0.0 2008.08.23 -
GData 2.0.7306.1023 2008.08.20 -
Ikarus T3.1.1.34.0 2008.08.23 -
K7AntiVirus 7.10.427 2008.08.23 -
Kaspersky 7.0.0.125 2008.08.23 -
McAfee 5368 2008.08.22 -
Microsoft 1.3807 2008.08.23 -
NOD32v2 3382 2008.08.23 -
Norman 5.80.02 2008.08.22 -
Panda 9.0.0.4 2008.08.23 -
PCTools 4.4.2.0 2008.08.23 -
Prevx1 V2 2008.08.23 -
Rising 20.58.52.00 2008.08.23 -
Sophos 4.32.0 2008.08.23 -
Sunbelt 3.1.1575.1 2008.08.23 -
Symantec 10 2008.08.23 -
TheHacker 6.3.0.6.060 2008.08.23 -
TrendMicro 8.700.0.1004 2008.08.23 -
VBA32 3.12.8.4 2008.08.23 -
ViRobot 2008.8.22.1346 2008.08.22 -
VirusBuster 4.5.11.0 2008.08.23 -
Webwasher-Gateway 6.6.2 2008.08.23 -
Additional information
File size: 24576 bytes
MD5…: cc4d8dc4dc3d638645ca952e11652f8a
SHA1…: 6105315ce7a8395de3dc76068be6344efacd736d
SHA256: 3c8af3e01d4c4c80251d1f09a81d43ccf56653e7e626da36967069964cbf88f0
SHA512: 81f02573b7d7d291c20d47cd7f672691d285c98adc0c91e002d0936b36fd987e
209800043b5318f5b6eacec7f990c3596d7680813fa5bbaae583d7a95e513c5e
PEiD…: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x401d54
timedatestamp…: 0x431a9b03 (Sun Sep 04 06:58:11 2005)
machinetype…: 0x14c (I386)

( 2 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x5216 0x5400 6.43 40f494fd06e1487724e0292f7ed7b791
.data 0x7000 0x1f78 0x800 1.71 9fd0d7b143f4fc6ccf3559a5b0b32038

( 1 imports )

KERNEL32.dll: CreateProcessA, GetCommandLineA, HeapFree, GetVersionExA, HeapAlloc, GetProcessHeap, ExitProcess, GetProcAddress, GetModuleHandleA, WriteFile, GetStdHandle, GetModuleFileNameA, UnhandledExceptionFilter, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, GetLastError, GetEnvironmentStringsW, SetHandleCount, GetFileType, GetStartupInfoA, HeapDestroy, HeapCreate, VirtualFree, LoadLibraryA, Sleep, GetACP, GetOEMCP, GetCPInfo, VirtualAlloc, HeapReAlloc, RtlUnwind, InterlockedExchange, VirtualQuery, SetFilePointer, LCMapStringA, MultiByteToWideChar, LCMapStringW, GetStringTypeA, GetStringTypeW, SetStdHandle, GetLocaleInfoA, VirtualProtect, GetSystemInfo, FlushFileBuffers, CloseHandle

( 0 exports )

4

If it is indeed a false positive and it certainly seems so, see http://forum.avast.com/index.php?topic=34950.msg293451#msg293451, how to report it to avast! and what to do to exclude them until the problem is corrected.