During normal navigation on internet, Avast ( VPS 665-0) has signalled me the presence of a trojan in a folder of Outpost Firewall.
29/12/2006 20.01.37-SYSTEM-1868-Sign of “Win32:Small-DQL [Trj]” has been found in “C:\Programmi\Agnitum\Outpost Firewall\Plugins\AntiSpyware\spy6_inc.sdb” file.
At the same moment Outpost has signalled this alert:
20.01.38-Attempt to modify Outpost Firewall Pro files is prevented. Application: avast! antivirus service, Path: C:\Programmi\Alwil Software\Avast4\ashServ.exe.
Subsequently I have made the manual scanning of this file but results all OK .
Probably it is a false positive, but I don’t understand because Avast has signalled once only (following scannings with avast don’t give any alarm) ???
That looks like the spyware signature file, so it is obviously unencrypted signature being picked up.
I have disabled the anti-spyware plug-in of Outpost Pro as 1) it slows boot as it scans lots of files and because of that activity avast scans them too, 2) it is based on AdAware if you have that or any other anti-spyware you are covered (with exception of resident protection). I prefer firewalls just to do that be a firewall. Because I don’t have the anti-spyware enabled I don’t have the AntiSpyware folder.
That is just Outpost’s self protection kicking in as you effectively intercept processing and try to move or delete the detected file.
Yes, I know, but my pc is also used by my wife, I prefer to leave antispyware of Outpost active ;D
In facts, if I want to verify operation of antivirus/spyware protection, I leave my wife to navigate… after 5 minutes she always finds something ;D ;D ;D
Exclude the file is you easiest option.
Standard Shield, Customize, Advanced and
Program Settings, Exclusions
This file may well be updated in the future and may change its name, like spy7, so it may be easier to use wildcards to cater for this like c:*\AnitSpyware\spy*.sdb