Virus Cannot Be Removed from Windows 7 - Virtual XP Hard Disk

Avast Free Antivirus / Premium Security
1

My Problem:

From the Windows 7 Professional desktop:
I have detected a trojan virus named “Win32:Hupigon-ONX” contained within my XP Virtual Hard Disk archive file.

The file is located at:
C:\Users\ken\AppData\Local\Microsoft\Windows Virtual PC\Virtual Machines
Windows XP Mode.vhd

I can detect the virus by running Avast within Windows 7 desktop, but I cannot remove it.
I have tried other virus removal tools such as Spybot and Microsoft Defender without success.

From the Windows Virtual XP desktop:
I have yet to detect the virus running within the Virtual XP desktop.
I have tried doing a full disk scan using Avast, Spybot, and Microsoft Defender without any detection of the virus. Whereby, I cannot remove the virus.

My Platform:

OS:
Microsoft Windows 7 Professional, 64bit.
Virtual XP desktop installed.

Virus protection:
In Windows 7 Pro, 64bit: I’m running Avast build 4.8.1368, virus update version: 100324-1
In Virtual XP: I’m running Avast build 5.0.418, virus update version: 100324-1

DETAILS

Avast detected Win32:Hupigon about 3 months after the XP mode was installed.

I’ve updated the virus packages multiple times with different versions in the past few weeks, but the Hupigon virus is always detected on the Windows 7 desktop in file:
C:\Users\ken\AppData\Local\Microsoft\Windows Virtual PC\Virtual Machines
Windows XP Mode.vhd

When running Avast on Windows 7 desktop…

I get a Warning Popup reading:
When I click “Move to chest” I get a warning message “File to large to move.”
I also fear to click “Delete” since this may corrupt my virtual hard disk for XP mode.

When running Avast on Virtual XP desktop…
The virus remains undetected when running Avast on the Virtual XP desktop.
Thus far, I have run Avast, Spybot, MS Defender, and Malware Bytes Anti-Malware on the Virtual XP desktop without any detection of the Hupigon virus.

QUESTIONS

  1. What should I do to detect and remove this virus from my system?

  2. Is there some way for me to determine the location of the virus within the virtual hard disk .vhd file – so that I can better focus my virus removal tools?

Any assistance that you provide is much appreciated.

Ken Huebner
Software Engineer

2

The detection in the container VHD file may actually be detecting an unpacked virus database somewhere inside of the XP system, e.g. in the swap file (Windows Defender?)… or even a file that has already been deleted but its content is still present in now-unused sectors of the virtual disk.

So, if you don’t get any detection from inside of the XP system, I wouldn’t worry about it.