i scan the infected file with malware bytes,super anti spyware,spybot search and destroy,
all of them found nothing. Anyways i’ve moved the file to avast chest,not sure why got infected…
File: np268.tmp
Status: INFECTED/MALWARE
MD5: c873f9cae08a37c385a71e538b3971ed
Packers detected: -
Scanner results
Scan taken on 08 Dec 2008 17:04:14 (GMT)
A-Squared Found nothing
AntiVir Found nothing
ArcaVir Found nothing
*Avast Found Win32:Hupigon-MED
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
CPsecure Found nothing
Dr.Web Found nothing
F-Prot Antivirus Found nothing
F-Secure Anti-Virus Found nothing
*G DATA Found Win32:Hupigon-MED
Ikarus Found nothing
Kaspersky Anti-Virus Found nothing
NOD32 Found nothing
Norman Virus Control Found nothing
Panda Antivirus Found nothing
Sophos Antivirus Found nothing
VirusBuster Found nothing
VBA32 Found nothing
What is the infected file name, where was it found e.g. (C:\windows\system32\infected-file-name.xxx) ?
Check the avast! Log Viewer (right click the avast ‘a’ icon), Warning section, this contains information on all avast detections. C:\Program Files\Alwil Software\Avast4\ashLogV.exe
Is that Jotti you uploaded to ?
If so virustotal has more scanners (37 last count) and uses windows versions of scanners so may include more unpackers if the file happens to be an archive. GData uses avast as one of its two scanners so effectively only one detection in your list.
You could also check the offending/suspect file at: VirusTotal - Multi engine on-line virus scanner and report the findings here the URL in the Address bar of the VT results page. You can’t do this with the file securely in the chest, you need to extract it to a temporary (not original) location first, see below.
Thanks,cleaned the files. But how about the detected file in avast chest?
If delete the detected file in chest,is it just delete by right clicking or extract
to somewhere (to desktop etc) and use file shredder (Spybot) to delete it permanently?
You should still submit it for further analysis as a possible false positive.
There is no rush to delete anything from the chest, a protected area where it can do no harm. In fact by leaving it in the chest you can periodically scan it to see if the detection has been corrected.
Anything that you send to the chest you should leave there for a few weeks. If after that time you have suffered no adverse effects from moving these to the chest, scan them again (inside the chest) and if they are still detected as viruses, delete them.
When that time comes, deletion is the option you should choose (nothing else need be done) and not extract, that is just used to make a copy in a temporary location of your choice.
