Avast -- questionable finds

Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

DKTaber

Thread Starter
Joined
Oct 26, 2001
Messages
2,871
My AV is Avast (free). I've had it for a couple of years and have not been infected with ANYTHING – virus/worm/Trojan/spyware – in that time. . . until yesterday. Avast is scheduled to run a quick scan every Sunday at noon, and this time found "Malware-gen" in 3 files:

· igfxpers.exe in the \Intel\GFX_XP32_14.37.1.5029_PV_Intel\Graphics folder
· igfxpers.exe in the \Windows\system32\DRVSTORE\igxp32_[long number]
· A0006649.exe in the \System Volume Information\_restore{long number}\RP55

Knowing that igfxpers.exe is a legitimate graphics driver for my Intel mobo, I had Avast move the files to the Chest, not delete them. I then ran full scans with Malwarebytes and SuperAntiSpyware, both updated. They found nothing.

This morning I restored the two instances of igfxpers.exe to their original folders and ran a quick scan with Avast. It found no infected files. However, between yesterday and this morning, Avast was updated twice, so it's using an updated version of the pattern files, not the pattern files that identified igfxpers.exe as infected.

I have reported this to Alwil as a false positive. My guess is that something was wrong with the pattern files that were in place when the Sunday noon scan was and subsequent updates fixed it. I'm curious to know if anyone else encountered this bizarre finding and what, if anything, they did about it.
 

DKTaber

Thread Starter
Joined
Oct 26, 2001
Messages
2,871
Malware will often infect legitimate files. It doesn't necessarily mean it's your case. However, to be sure, you might want to send the files to:

Jotti's Malware Scan

or,

VirusTotal
Well, Jotti said that only one AV program identified it as infected -- Avast. Virus Total, which also scanned it with Avast, said none of the 42 programs found anything, and Avast on MY COMPUTER now also does not find any malware.

So where does that leave me?
 

Phantom010

Retired Trusted Advisor
Joined
Mar 9, 2009
Messages
34,801
Looks like a false positive to me.

Jotti's Avast possibly didn't have the latest definitions from Avast.
 

DKTaber

Thread Starter
Joined
Oct 26, 2001
Messages
2,871
Looks like a false positive to me.
That's what I think, and I submitted it to Avast as a false positive. Haven't had a response from them, but it's interesting that after a couple of pattern file updates, Avast no longer identifies it as infected. It suggests that between yesterday and today, Alwil discovered the error and fixed it. I was probably only one of many who bugged them about it.

Another clue: The last date of change for the infected files was 1/26/09 -- just under 3 years ago. If a virus had somehow attached itself to the file, wouldn't it change the last change date?
 

Phantom010

Retired Trusted Advisor
Joined
Mar 9, 2009
Messages
34,801
Another clue: The last date of change for the infected files was 1/26/09 -- just under 3 years ago. If a virus had somehow attached itself to the file, wouldn't it change the last change date?
Probably but it's hard to tell how malware is infecting those files. Will it always change that date and be easily recognizable? Good question.
 
Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Users Who Are Viewing This Thread (Users: 0, Guests: 1)

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 807,865 other people just like you!

Latest posts

Staff online

Members online

Top