Suspected Win32-Evo-Gen please help!!

Viruses and worms
1

Suddenly I’ve started to get a warning about a virus being found when I turn my laptop on every time.
It’s identified as Win32:Malware-gen. So I deleted it as Avast recommended and did the boot log too.
I had no knowledge about this kind of issue, but I’ve scanned my laptop with TDSSkiller (which found no infected file) and ComboFix as some people who seem to have similar problem as me were suggested to do with the instruction…

Still now the alarm for the same file comes every time when I restarted my laptop…
Any help would be appreciated!

2

Please follow these instructions: http://forum.avast.com/index.php?topic=53253.0

3

I’m attaching the log result for ComboFix here just in case…

4

Win32-Evo-Gen [susp] = suspicious

what is the name of the file detetced?..post full file path to the file

upload the file to www.virustotal.com and test with 40+ malware scanners
post link to scan result here

alternative: www.metascan-online.com / www.jotti.org

5

Thank you for your help.
I tried all three scan website. For some reason, the result weren’t showed at www.virustotal.com and www.metascan-online.com, instead blank pages were showed at the end…
and the scan at www.jotti.org seemed working properly but found nothing.

the name of the file is
C:\ProgramFile\OddPowerSwitch\OddUtlsv.exe

6

OddUtlSv.exe is known as NEC DVD/CD Power Switch and it is developed by NEC Corporation, NEC Personal Products, Ltd. .
http://processchecker.com/file/OddUtlSv.exe.html

so do you know this program?..your factory installed DVD/CD player i guess

7

You can upload files and report issues to avast here : http://www.avast.com/contact-form.php (select subject according to Your case)

You can use mail
send to virus@avast.com in a password protected zip file
mail subject: False Positive / undetected sample (select subject according to your case)
zip password: infected

or you can send files from avast chest
how to use the chest. http://www.avast.com/faq.php?article=AVKB21

8

Thank you,
Yes, I know this file. I think it’s factory installed as you said.

I’ll report the issue asap, however still not sure if my laptop is safe or not???

9
I'll report the issue asap, however still not sure if my laptop is safe or not???
it is just a suspicious detection....and to me it seems to be a False Positive

give a link to this topic when you report it

10

Sure, Thank you so much for your help!!!

11

Been getting this message about every 20 minutes during the last 12 hours (that I’ve noticed). Screen capture included to show path of file.

Thanks,
TJ

12

Hello,
send the file to virus@avast.com and put “False positive” to email subject.

Milos

13

path to file:
E:\Seagate Dashboard 2.0\HP-DESKTOP\LoVerde\Backup\c42c0445-3918-4199-87b8-fe07af43c7af\20130308_215140_LoVerdeInc682\C\Old IBM Laptop\VRMPVOL_EN (D)\I386\svcpack\0_DOTNET11SP1.exe

Link to results on virustotal.com:

https://www.virustotal.com/en/file/d03846ecc443a3627b52838128b077bca646dfbfef6d2900b1114ccf2898bed8/analysis/1383922877/