FP for Windows XP Professional.vmdk (Virtual machine VMare player)

Viruses and worms
1

Hello.
Today, after updating of avast! (Free, the last version 5), it decided to delete the virtual hard-drive of VMware Player, as a trojan horse. Here is the message displayed by avast! :

http://i37.tinypic.com/16bf1a9.jpg

I’ve created my virtual machine 3 times but alway with the same result - deleted by avast!, as a trojan horse. Yesterday I’ve not such a problem…
Avast! delete the virtual hard-drive of VMware Player when I start or turn off virtual machine but not when it is already runing (immediately after installation, before I to powered it off…)

I think that this is a false positive and put the virtual hard-drive of VMware Player as an exception…
Please, check this issue.
Best regards.

2

Yes, most probably…
But, can’t you install avast in the virtual machine and check the files in there?

3

It’ll be difficult… because avast! detects and deletes the virtual hard-drive (vmdk) (about 15Gb…), and not a small file… vmware-vmx.exe is a clean file…:
http://www.virustotal.com/analisis/a8e8e1e15d98bfcc31771cd8e8d647ca2dcce011652af5b579c4937d45f60272-1280954702

4

No, it’s easy.
Add an avast exception for the vmdk file (File Shield settings).
And then start the virtual machine, install avast, boot, scan.

5

I’ve done what you suggest me:

  1. I’ve installed avast! on my virtual machine.
  2. I’ve performed a full boot-time scan.
  3. The program detected nothing. This was a brand new virtual machine, as the previous two, detected and deleted by avast!.
  4. I think that avast! detects not some malicious content of the virtual (virtual hard-drive) machine but just the virtual disk itself when it is initialized/changed by VMware Player.
    I’m not a specialist, but this seems to be quite annoying FP…
6

Do you use Microsoft Security Essentials on that virtual machine?

False positives on virtual machines could occur. I, myself, have the disks on the avast exceptions.

7

No, I don’t use MSE or any other antivirus on the virtual machine. Only Wondersahre TimeFreez and DefenseWall. Even without any of them, the result is the same… This problem appear just yesterday, after the last update of avast!

8

Hope the virus analysts take a look in the Win32:Ertfor [Trj] signatures…

9

Thanks any way, I hope too…