ClamWin Free Antivirus :: View topic - Trojan.Small-152 FOUND in *\Acertools\Restore.exe

Posted: Mon Feb 13, 2006 8:11 pm

Clamwin reported Trojan.Small-152 in C:\WINDOWS\system32\Autorun\ACER\TOOLS\Restore.exe and moved it to quarantaine folder. Problem is this file is a part of ACERs System Restore Application and has never beeen altered after install and you can see
all other scanners on VirusTotal.com (see list below) did not find a virus furthermore the md5 hash mentioned on TU Berlin - Hoax-Info.de https://www.tu-berlin.de/www/software/showtxt.shtml?tcom121205av https://www.tu-berlin.de/www/software/showtxt.shtml?tcom121205av:
Trojan.Small-152
md5 hash: 6a5d3977900c019fa75e7ef48bd42672
Size: 9.760 Bytes
Extension:*.pdf.exe.
Restore.exe:
md5 hash: C562D2D5D40DAD9000C5076742B9C9A2
Size: 1.409.024 Bytes (on Disk)
Extension: *.exe

Please let me know if this is real virus or a postive false dedection from AV database:main.cvd is up to date (version: 35, sigs: 41649, f-level: 6, builder: tkojm)
daily.cvd updated (version: 1281, sigs: 2404, f-level: 7, builder: sven)
.

Antivirus Version Update Result
AntiVir 6.33.0.81 02.13.2006 no virus found
Avast 4.6.695.0 02.13.2006 no virus found
AVG 718 02.13.2006 no virus found
Avira 6.33.0.81 02.13.2006 no virus found
BitDefender 7.2 02.13.2006 no virus found
CAT-QuickHeal 8.00 02.13.2006 no virus found
ClamAV devel-20060126 02.13.2006 Trojan.Small-152
DrWeb 4.33 02.13.2006 no virus found
eTrust-InoculateIT 23.71.74 02.11.2006 no virus found
eTrust-Vet 12.4.2077 02.13.2006 no virus found
Ewido 3.5 02.13.2006 no virus found
Fortinet 2.54.0.0 02.13.2006 no virus found
F-Prot 3.16c 02.13.2006 no virus found
Ikarus 0.2.59.0 02.13.2006 no virus found
Kaspersky 4.0.2.24 02.13.2006 no virus found
McAfee 4695 02.13.2006 no virus found
NOD32v2 1.1405 02.13.2006 no virus found
Norman 5.70.10 02.13.2006 no virus found
Panda 9.0.0.4 02.13.2006 no virus found
Sophos 4.02.0 02.13.2006 no virus found
Symantec 8.0 02.13.2006 no virus found
TheHacker 5.9.4.094 02.10.2006 no virus found
UNA 1.83 02.13.2006 no virus found
VBA32 3.10.5 02.13.2006 no virus found

wbr Peter Palicka

Code:

Posted: Mon Feb 13, 2006 10:57 pm

it appears a false positive to me,

read this FAQ https://www.clamwin.com/content/view/40/27/ to submit a false positive