avast detected a trojan Win32:Auto-IT-I in all my files in my USB thumb drive. I moved them all to the virus chest. what do i do now? can i still use the infected files?
To know if a file is a false positive, please submit it to JOTTI or VirusTotal and let us know the result. If it is indeed a false positive, send it in a password protected zip to virus@avast.com
Please, mention in the body of the message why you think it is a false positive and the password used. Thanks.
VirusTotal and Jotti both have file size limits 10 and 15MB each.
As a workaround, you can add these files to the Standard Shield provider (on-access scanning) exclusion list.
Left click the ‘a’ blue icon, click on the provider icon at left and then Customize. Go to Advanced tab and click on Add button…
You can use wildcards like * and ?. But be carefull, you should ‘exclude’ that many files that let your system in danger.
After that, please, periodically check it - scan it into Chest, right clicking the file - there should still be a copy in the chest even though you restored it to the original location. When it is no longer detected as being infected then you can also remove it from the Exclusion list.
This link is a tutorial on how to help correct a virus detection that you believe to be false:
http://forum.avast.com/index.php?topic=25009.msg204838#msg204838
or http://forum.avast.com/index.php?topic=7779.msg62586#msg62586
How many files are there?
there are more than 100 files
Do you recognize the file names or are they new on the drive?
yes,i recognize all the file names.
Though I have no explanation for this number of false positives I’m guessing they are false positives because a trojan is not a file infector; rather, you would see new malicious files.
Just to play it safe try Tech’s Virus Total suggestion on a random sampling of the files and see if any other antivirus scanners detect anything. If there are detections please post the scan results.
I got a problems before with a trojan that are infected .exe files…
After installed avast…all the application are infected by this virus…
i didnt know the virus name…because i having this same problem during last year when i go to school…
I just format back the computers…
During the bootscan all the virus are deleted…but after login avast detect the virus again and the virus is the avast program…
There is a type of trojan that can replace executable files and it appears the file has been infected. I’ve never seen it happen on a USB drive, though.
But if you mean a virus instead - that’s a true file infector.
submitted some of the infected files to TOTAL VIRUS for scanning. all scans turned out negative
Send some files to virus@avast.com in password protected archive (zip, 7z). As password use “virus” without quotes. To subject write “false positive”. We take a look and let you know result.
how do i send thru zip?
Just zip the files with winzip and attach it to the email. Follow the instructions above.
This seems to be the periodic detection of auto-it scripts as infected.
There is a problem in that auto-it is used by some script kids to compile malware so often there is a hiccup where there might be close resemblance to a malware script.