So I downloaded the Zoek tool because I saw it in another thread being used to look at browsers and when I open it I look at Killswitch and it calls it TrojWare.Win32.Hupigon.ogkx. I’m doing scans right now and I also saw Avast make a firewall rule for a software downloader so whats up with this? Running scans now and also noticing that my keypresses seem lagged.
upload suspicious file(s) to www.virustotal.com and test with 40+ malware scanners
post link to scan result here
if you want a analyzis result, you can now try to upload it to Sophos lab as possible False Positive, they are usually quick to reply
https://secure2.sophos.com/en-us/support/contact-support/sample-submission.aspx
also give them link to the scan result
you can also send it to avast lab here. http://www.avast.com/contact-form.php
or if you have the file in avast virus chest, right click and upload…
it will then be sendt at next avast auto/manual update
zoek is simular as ComboFix. Zoek perform such system actions so AV simply target thouse tools as suspicious. It’s heuristic detection.
Later on, If any AV products on VirusTotal detect file as suspicious, it’s been send a file copy to all other AV vendors.
Other AV Products without further file-analysis just add the signature and there you go FP detection
Norman lab confirmes this was a False Positive detection on UPX packer
Well at least that’s sorted. A quick question If I disabled Java with Avast! for google how do I re-enable it without using the interface?