Flagged possible FP showing up in other AV afterwards? InteractiveHost32.ni.exe

Viruses and worms
1

Hi everyone,

On May 30th the InteractiveHost32.ni.exe file was flagged by Avast and put in the Virus Chest 5 times.
As it was buried deep into the Windows folders (C:Windows/Assembly/NativeImages…) I wonder if it was a FalsePositive.
I reported it for further analysis and just ran a VirusTotal scan on it:
https://www.virustotal.com/gui/file/b85b041b4f48f96c79b63ff3cd87fab5b01b67cd4668424d2b40adf05948a9ac/detection

Even though Avast does not seem to pick it up anymore, one other AV does.
Any thoughts?

Many thanks.

2

That VirusTotal doesn’t appear to be the same as the file name in your subject title (InteractiveHost32.ni.exe) ?

If avast detected it, is it in the virus chest ?

3

Yes, it is placed in the virus chest 5 times (same file) where it is called with the .ni.exe as file extension.
I created a new folder on my desktop and extracted one of the files there to scan it with Virus Total.
The results are as I attached via the previous link.

Hope this helps.

4

Also, not sure how ni.exe files are perceived, but in the details field in the VirusTotal scan it is shown to have 2 names (?).

5

Sorry for the spam, but perhaps this makes it easier (see attachment).

6

Since this was back in May 30 2020, have you been getting any further detections from then ?

If not, have you used the Send one of files in the chest for analysis option within the virus chest ?

7

Thanks David.
No, the only detections were on that day for those 5 cases that are still in the virus chest.
I have send one of those files for analysis that actual day. The reason why I am coming back to this is just to check what the outcome was and if my PC was at risk.
Seemingly, if I now scan that file with Avast / Defender it is not picked up (making me believe that it was indeed a FP). But since 1 in the VirusTotal scan did pick it up it still makes me wonder.

8

When only 1 virus scanner of 72, given that is also Qihoo-360 and it is a Win64/Trojan.ae7, a pretty indistinct malware name. Then there is a strong possibility that this is/was a false positive detection, hence no further detections by Avast.

9

Yes indeed, that was also my first thinking.
In any case, I got note that I will receive an outcome of the “further analysis” of this particular detection in the next 48 hours.
I will post that here when I receive it to inform everyone that is interested.

10

Thanks, hopefully you will get a response that it is clear.

11

Hello,
the detection was fixed on 2020/06/01 already.

Milos

12

Thanks for the clarification.