W32:Crypt

Viruses and worms
1

Immunet Protect detected and quarantined W32:Crypt in C:\Windows\Temp_avast5_\unp204022784.tmp. Also it said Installed by: C:\Program Files\Alwil Software\Avast5\AvastSvc.exe.

I clicked restore so that I could upload it to virustotal. I’m thinking maybe it’s a file that avast caught or something and placed it there? or a file that was infected that avast found so it moved to a temporary location but I checked all the shields and logs and avast has said nothing.

virustotal results 6/41

http://www.virustotal.com/analisis/8fdc1917146055ac787a905972344b9029dc1ac4b8f789f99e50775833ebbe35-1265066062

any ideas?

jotti results 3/20

http://virusscan.jotti.org/en/scanresult/f36445e9741d6292ab9a8747f307f2dfc292c21d

2

Hardly spawned by avast, the C:\Windows\Temp_avast5_\ folder is where avast unpacks files to be scanned.

What is happening is Immunet Protect is conflicting with the avast scanning process. As avast extracts a file into that temporary folder Immunet Protect is hooking/locking the file so that it can scan it. That effectively blocks avast from scanning it.

If Immunet weren’t there then avast would scan the file (and hopefully alert and deal with it according to the pre-set actions and clear the avast5 folder) or even if it was not detected avast cleans up after the scan emptying the avast5 folder.

You have to exclude the C:\Windows\Temp_avast5_\ from Immunet Protect or expect this conflict again, but avast most certainly spawning malware.

3

I know that, Just made that the subject since immunet is basically saying that it is. Not saying avast did it :P. However, is it a legitimate threat that avast is TRYING to scan, but says it is clean because immunet is messing with the file?

EDIT changed thread title to avoid confusion.

4

No, avast can’t scan it as immunet has the file locked, not that avast hasn’t detected it.

So avast hasn’t said anything as it hasn’t scanned it, first it is hooked blocking a scan and then immunet removes it from the avast5 temp folder.

5

I find this thread looking for information on W32.Crypt. Not to bring up very old news though I have confusion. The claim is that Avast would have detected this file. But looking at DarkLegend post he has link to Virus Total results and they shows that Avast did not detect it. Forums like these are in a humble opinion for discussion with truthfulness not to incorrectly blame. Threat would not have been detected at the time by Avast but was correctly detected by Immunet software. No one is perfect and all such security softwares can miss threats, and it is good for darklegend to protect itself several ways.