Avast tonight reported a Win32 worm, Vybab, in \Norton Antivirus\NAVW32.exe. I first moved it to the Virus Chest so I could check the file date, then I deleted it from there. The file date appears to be correct, 2002, for this version of Norton. NAV was my previous antivirus program before I installed Avast about a month ago. I am not running Norton resident, obviously, but I had not uninstalled it. Do you think this is a false positive or could the Norton navw32.exe have become infected? Anyone else see this?
Hi Denro,
Since the new antivirus dat downloaded yesterday (0312-8) Avast! has been finding the Vybab worm in .rbf files in my C:\RECYCLER\NPROTECT which I think is to do with Norton isn’t it?
Prior to Avast! I had Norton 2003 Systemworks installed on my comp and I wouldn’t like to bet this is just pure coincidence.
I’ll try to get some more info and post something if I can find anything else out.
;D
Trooper
I performed a thorough scan and a boot time scan and found 7 more instances of this w32/vybab worm. Three total in Norton AV files (exe and dll’s) and 5 more in the compressed files that are part of system restore (I am running Win XP.) I researched the worm a bit over at netword associates site and am convinced it is not a false positive. I don’t know when the machine became infected, but there has never been a day when I wasn’t running either NAV or Avast both up to date with signature files. I am relieved that Avast caught this in any case.
It is a false alarm. We are very sorry of it. It’ll be repaired in the next virus database update, scheduled for tomorrow. In the meantime, you can put the files to the scanning exception list.