7/10/2009 6:33:57 PM Owner 1428 Sign of “Rootkit: hidden file” has been found in “C:\WINDOWS\Temp_avast4_\unp23992893.tmp” file.
7/10/2009 6:33:59 PM Owner 1428 Sign of “” has been found in “C:\WINDOWS\Temp_avast4_\unp23992893.tmp||AntiRootkit [FILE]|||10|0|2|COO1||COO2||” file.
False positive or ???
Hijack This Logs
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:19:55 PM, on 7/10/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Use MBAM (or SUPERantispyware or even Spyware Terminator) to scan for spywares and trojans. If any infection is detected, better and safer is send the file to Quarantine than to simple delete them.
This location the avast4 folder is where avast unpacks archive files to be scanned, signified by the unp999999.tmp file names where the 999999 is a random number. These files should be cleared after avast has unpacked and scanned the archive. So something happened to stop these temporary files from being removed.
This has happened in some cases because of having another AV or resident security application installed as avast unpacks the files in the avast4 folder the other application can try to hook/lock these files to scan them and this could stop avast from a) scanning them and b) removing them from the temp folder so they are subsequently detected on an on-demand scan.
This however, is theory and I see no security application in your HJT log that would be capable of this hooking/locking of the file. So to me it just looks like avast for some reason didn’t clear the temp folder after scanning.
Yes as I said nothing on your system should get in the way and this is just a hiccup. Clearing out that sub-folder and or sending it to the chest would resolve any issue. Even if it were left there it is effectively inert (not active) as there is nothing that knows it is there, so nothing would be able to run it.
That isn’t strange at all as it isn’t a conventional detection but one using heuristics in the anti-rootkit scan and those are the only options. Because it is a heuristic detection it is airing on the side of safety in recommending Ignore, but gives you the option of deletion.
You should also have got this message in the alert: “A suspicious file has been detected (using a heuristic method). This may be a sign of malware infection. Please allow the file to be submitted to our virus lab for analysis.”
Who said its a false positive, certainly not me or anyone else.
All that has been said is that this is a file that avast unpacked into its temp folder that should have been removed after the scan. I haven’t the slightest idea why that didn’t happen, but consequently it is being detected and as the message suggests you should allow it to be sent for analysis and avast uploads it during the next update.
So that really is what you should do for avast to analyse it, then and only then would you know if it is a false positive as subsequent scans would either not detect it (an indication of a false positive) or it could be detected by a conventional signature (created after analysis) so that conventional scans could detect it and not just the heuristic anti-rootkit scan.
