Win32:Malware-gen and Win32:Evo-gen [Susp]

Viruses and worms
1

I ran a full system scan today, and it found the Win32:Malware-gen virus, file name HPLocale.exe, location C:\HP\BIN. I moved it to the virus chest, and ran a boot scan as suggested by Avast. The boot scan was clean. I ran MalwareBytes (log is attached), although I was not able to update the virus database, it would stop during the process (tried several times). I tried to download the FABAR tool through the link in the stickied post, and Avast is blocking the FRST (1).exe download every time, identifying the Win32:Evo-gen [susp] virus and moving it to the chest. Any suggestions on how to proceed?

Thanks for your help!

2

malware-gen is not a virus.
It is a SUSPicious file.

Disable avast
Download Farbar
Run it
attach the logs to your next post
Don’t forget to enable avast again!

3

See attached for logs, was able to download FABAR with Avast disabled. Let me know if you need anything else.

Thank you!

4

For now this is enough.
A malware removal expert will soon have a look at them and guide you further.

5

Hello,

can I ask you for your avast program and VPS versions? Because we had FP on HPLocale which was fixed yesterday in stream updates

6

Hello,
this was false positive and should be fixed now by stream updates.

Milos

7

Good day. We are using a PPTX to EXE converter (Enterprise) from Vaysoft and DRMsoft PPTX to EXE Advanced Converter to distribute our Powerpoint shows to paid customers. The last 3 days we were inundated with calls from angry customers complaining that Avast deleted our products. They are demanding their money back. How can we fix this?? Even when trying to convert a PPTX to EXE Avast deletes the file immediately. You are breaking my business with this new manner of deleting files without giving the user the opportunity to exclude the files. Our powerpoint shows are, or rather, were used in the South African Primary Schools and in the homes of the learners. Now nobody can use our product and with right are they not very happy. How can we fix this?? Sometimes we get the Win32:Malware-gen and sometimes the Win32:Evo-gen [Susp] warning. Please help!!

8

Avast Internet Security
Program 2015.10.0.2208
Virus definition version 150208-1 (looks like it updated this morning)

So, this is a false positive and everything should be okay? I had run a full system scan on 2/4 with no results, so if there was something it had to be recent.

9

Yes.