I think I might have a false positive: Win32:Trojan-gen {VC}

Viruses and worms
1

Well I just did a deep scan with Avast. It came across this:

The file is located in:
C:/Documents and Settings/Local Settings/Application Data/Pixoria/Konfabulator/Popcheck Mail Checker mk2.widget/Popcheck Mail Checker.widget/Contents/retrieve.exe

I know that Konfabulator is free of any malware, and any widgets associated with it off their site is free of malware too. Could this be a false positive? or should I delete it immediately? Thanks in Advance.

I just tried to upload at Jotti, but no go. It says: The file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware is prohibiting you from uploading this file. It’s not my firewall…please advise.

2

You can test it uploading to Virustotal (http://www.virustotal.com/xhtml/index_en.html)
Can’t you send the file to Chest? From there, you’ll be able to re-send it for Alwil for analysis.

3

Yes, infact I just sent it to the chest. I’ll email it right away.

4

sigh. It says it’s too big to send by email. It’s almost 2MB in size.

5

You can restore the file to an USB drive, for instance, zip it and upload to the any of these anonymous ftp servers:
ftp://ftp.asw.cz/incoming
ftp://www2.asw.cz/incoming
Although Alwil does not like to receive ‘samples’ uploads through ftp…

6

Well I got my friend to zip it and try to upload the file. He says there are no write permissions on either of the ftps.

7

There are write permissions on the FTP - actually, there are only write permissions there (so you cannot see anything, not even the file you upload - but it shouldn’t be a problem).

8

Alright, I’ll tell my friend about it, hopefully I can get the file uploaded later today.

9

Oh I finally sent the file through regular email to the avast team. All I had to do was adjust the setting on file sending to more than 1024 kb. Thanks for all the help.