Hundreds of False Positives? (Win32:Malware-gen)

Avast Business Avast Endpoint Protection
1

My monthly workstation virus tests are running today, and I have hundreds of virus alerts in my mailbox. These are either .tmp files or .dll files that seem to relate to our hp printers. They are flagged on more or less every workstation on the network.

The notification emails are as follows:

avast! [4S3TP4J-WIN7]: File “C:\Windows\System32\spool\drivers\w32x86{871B839C-B86D-40AA-A5FA-DCBD145B236E}\SET4363.tmp” is infected by “Win32:Malware-gen” virus.
“File System Shield” task used
Version of current VPS file is 130627-1, 27/06/2013

Anyone have any thoughts as whether these are genuine issues or false positives?

Kind regards,
Stephen

2

Hello,
send the detected files to virus@avast.com and put “False positive” to email subject.

Milos

3

Ah, good. Thanks for that.

4

Just in case, before writing it off as a FP, run a scan on your print server using an online AV scanning tool.

We had a similar issue the other year with similar alerts and it turned out the Print Server was infected.

5

Thank you. I’ll be sure to do that now that I am back in the office.