Virus in conf.dat file?

Avast Free Antivirus / Premium Security
1

Hello everyone, I was hoping someone could shed some light on an alert I received from Avast while online.

I had Yahoo Messenger running and my browser. I was just clearing out the browser’s cache when I got a virus alert from Avast telling me it had found “Mirror-4130” in a “conf.dat” file and recommended that I send it to the virus chest… which I did.

After I moved the file, I went to the directory in question and there was still a “conf.dat” file in there… I guess Avant (my browser) creates another conf.dat file when it’s deleted or moved. I scanned the file with Avast and it was clean.

I also did two thorough scans of my drive afterwards… both came up clean.

This just “feels” like a false positive to me.

Can someone explain to me what “Mirror-4130” is and why it would infect a conf.dat file? What ~is~ a conf.dat file anyhow?

Here are the details from the virus chest.

Original file name conf.dat
Original folder C:\Documents and Settings\Owner\Application Data\Avant Profiles.default\conf
Size of file 1220
Last modification time 6/26/2008 10:45:19 PM
Time of transfer to Chest 6/26/2008 5:46:11 PM
Catagory Infected files
Virus description Mirror-4130
File ID 7

Any info would be ~greatly~ appreciated!

–steve

2
This just "feels" like a false positive to me.
Right click the file into Chest and scan it there. Is it clean now? If so, most probably a false positive.
What ~is~ a conf.dat file anyhow?
Configuration.data file most probably...
3

Hi Tech, thank you for the reply!

No, Avast still recognizes it as a virus. But the conf.dat in the directory where it was first found is clean.

I can’t see how a virus would be in a configuration file. Is that possible? Even though the file in the virus chest still registers as a virus, isn’t it possible that it’s still a false positive?

4

Who knows ???

Yes, it’s possible. But, if you have the original file in the folder, you shouldn’t worry about keeping this into Chest for further analysis.

5

Well I use Avant as my secondary browser so I just scanned the Conf folder and no alert, see image.

I’m using Version 11.6 build 19 which if not the latest one is very recent (build 20 is the latest), what version are you using ?