jb
Joined: 16 Jan 2010 |
Posts: 0 |
|
|
 |
Posted: Sat Jan 16, 2010 4:26 am |
|
 |
 |
 |
 |
I believe the following is not correct...
Scanning aborted...
C:\Windows\assembly\NativeImages_v2.0.50727_32\Interop.XobniRdo\8078d92cd70d5ed0fdd9a6e1eb397660\Interop.XobniRdo.ni.dll: W32.Virut.Gen.D-150 FOUND
----------- SCAN SUMMARY -----------
Known viruses: 698595
Engine version: 0.95.3
Scanned directories: 29682
Scanned files: 228990
Infected files: 1
Not moved: 1
Data scanned: 60836.69 MB
--------------------------------------
Cancelled
--------------------------------------
|
|
GuitarBob
Joined: 09 Jul 2006 |
Posts: 9 |
Location: USA |
|
 |
Posted: Sat Jan 16, 2010 4:01 pm |
|
 |
 |
 |
 |
The Virut Generic signatures sometimes give a false positive on some Microsoft files, so this could well be a false positive. To verify it, you can upload a copy of the file to Jotti at https://virusscan.jotti.org/en or to VirusTotal at https://www.virustotal.com/ on the web. Either service will scan the file for you with multiple AV programs (including Clam AV, which furnishes the scan engine/database for ClamWin). If more than two or three AVs find an infection, it is probably a real infection and not a false positive. I would believe an infection if the detecting AVs include a couple of these: Kaspersky, McAfee, Microsoft, Nod32, Symantec, or Trend Micro. You should upload false positive files to Clam AV at https://www.clamav.net/sendvirus/ on the web. When you get to the upload page, be sure to tell them the name of the virus that is falsely identified and the results of your Jotti/VirusTotal scan.
An alternative to verifying a false positive is to upload the file to Threat Expert at https://www.threatexpert.com/submit.aspx on the web. They will "run" the file and give you an email report, which includes a threat estimate.
If you look at the date of your file in Windows Explorer, you can see when the file is dated. If the date is not recent, it is probably a false positive detection.
Regards,
|
|