False positive

Viruses and worms
1

I am getting a trojan alert from Avast. The file is igfxpers.exe. On jotti only avst and ikarus are finding it malware.
Is this a false postive? The same file in a Acronis image from several months ago is according to avast als infectected but at that time it was clean. It is a systemfile in C:\windows\system32 so i am waiting for a answer before a take any action.

2

Seems a false positive…
Does this help?

http://www.processlibrary.com/directory/files/igfxpers/
http://www.neuber.com/taskmanager/process/igfxpers.exe.html
http://www.liutilities.com/products/wintaskspro/processlibrary/igfxpers/

3

You could also check the offending/suspect file at: VirusTotal - Multi engine on-line virus scanner and report the findings here.

This is I believe a better multi-engine scanner than Jotti as a) ir uses windows versions of the scanners and b) it currently has 36 scanners (much more than Jotti), however the result is likely to be the same but with more scanners.

4

with the newest database update is evrything oke… it was a false positive…

5

Thanks for reporting back and helping the database accuracy :wink:

6

same thing also on my pc, avast found some files IGFXpers…I put in the chest and keep there for two days waiting for a new updates. Soon I get the new update I restore the files from the chest and make new scanning, everything was fine. In the future, when avast detect files infected put them always in the chest and wait, DO NOT CANCEL, NEVER. When you get a new update make a new scanning( remember to restore the file from the chest) before.

7

Whilst it is wise never to delete but to send to the chest, that should be accompanied by ‘and investigate’ as just waiting and scanning again might not be enough.

For avast to correct a false positive, first it must be identified as a false positive by analysis at virustotal, etc. and then the sample needs to be sent to avast for analysis and correction. If no one checks at virustotal and sends a sample avast wouldn’t know and you could be waiting a long time for it to be corrected.