« previous next »
Pages: 1 [2]   Go Down

Author Topic: AVAST-Message: Worm MOTA113.exe  (Read 25410 times)

0 Members and 1 Guest are viewing this topic.

Avastfan1

  • Guest
Re: AVAST-Message: Worm MOTA113.exe
« Reply #15 on: February 22, 2009, 03:38:43 PM »
Dear Avast Forum Users,

Today I too received the report of the MOTA113.exe infection and the SUPER infection as mentioned earlier in this thread. Did a boot time scan and the details are as follows:

02/22/2009 12:54
Scan of all local drives

File C:\Program Files\eRightSoft\SUPER\spk\Movawin.spk\[tElock]\[PECompact]\[Embedded_I#15e7bc]\[tElock] is infected by Win32:Trojan-gen {Other}
File C:\WINDOWS\MOTA113.exe\[tElock] is infected by Win32:Trojan-gen {Other}

I scanned my system with:
- Blacklight anti-rookit - no infections or other items found
- MBAM - no infections or other items found
- Spybot - no infections or other items found
- Rootalyzer - no infections or other items found
- ZA Anti-Spyware - no infections or other items found
- SuperantiSpyware - no infections or other items found
- Hijackthis Log submitted to http://www.hijackthis.de/ - no items marked as dangerous

I believe these two items are false positives.

I managed to submit the SUPER file (Movawin.spk) to virustotal and jotti.org and only Avast and one other recognised an infection. Although it said the other virus scanner was only a heuristic detection.

I tried to submit the MOTA113.exe file to both but Avast went mental with the warning things and I clicked 'no action' which subsequently resulted in Avast preventing me from uploading them.

In an ironic way I am glad that others have got this message - as it strengthens the possibility that it will be a false positive. Purely for the reason that if everyone reports the same infection at the same time!!

Hope this will be a false positive and hope it will be corrected in the next VPS.

Avastfan1
« Last Edit: February 22, 2009, 03:42:22 PM by Avastfan1 »
Logged

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67194
Re: AVAST-Message: Worm MOTA113.exe
« Reply #16 on: February 22, 2009, 04:07:54 PM »
Aren't you asking twice the same? Haven't you open another thread with the same problem? ???
Logged
The best things in life are free.

Avastfan1

  • Guest
Re: AVAST-Message: Worm MOTA113.exe
« Reply #17 on: February 22, 2009, 10:28:44 PM »
Hi Tech,

No, this is the first post I have made on this topic. This issue only started for me a few days ago.

Thanks,

Avastfan1
Logged

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67194
Re: AVAST-Message: Worm MOTA113.exe
« Reply #18 on: February 22, 2009, 10:33:07 PM »
Sorry.
You can search the board for MOTA113.exe and you'll find more info.
Logged
The best things in life are free.

Avastfan1

  • Guest
Re: AVAST-Message: Worm MOTA113.exe
« Reply #19 on: February 22, 2009, 10:59:39 PM »
Hi Tech,

Thanks for the response. I searched this forum for MOTA113.exe as you suggested. The only thread it returned was this one.

I'm a little unsure how I should proceed on this issue :(

Yours sincerely,

Avastfan1
Logged

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67194
Re: AVAST-Message: Worm MOTA113.exe
« Reply #20 on: February 22, 2009, 11:57:10 PM »
Logged
The best things in life are free.

billman1037

  • Guest
Re: AVAST-Message: Worm MOTA113.exe
« Reply #21 on: February 23, 2009, 07:35:18 PM »
Quote from: Avastfan1 on February 22, 2009, 03:38:43 PM
Dear Avast Forum Users,

Today I too received the report of the MOTA113.exe infection and the SUPER infection as mentioned earlier in this thread. Did a boot time scan and the details are as follows:

02/22/2009 12:54
Scan of all local drives

File C:\Program Files\eRightSoft\SUPER\spk\Movawin.spk\[tElock]\[PECompact]\[Embedded_I#15e7bc]\[tElock] is infected by Win32:Trojan-gen {Other}
File C:\WINDOWS\MOTA113.exe\[tElock] is infected by Win32:Trojan-gen {Other}

I scanned my system with:
- Blacklight anti-rookit - no infections or other items found
- MBAM - no infections or other items found
- Spybot - no infections or other items found
- Rootalyzer - no infections or other items found
- ZA Anti-Spyware - no infections or other items found
- SuperantiSpyware - no infections or other items found
- Hijackthis Log submitted to http://www.hijackthis.de/ - no items marked as dangerous

I believe these two items are false positives.

I managed to submit the SUPER file (Movawin.spk) to virustotal and jotti.org and only Avast and one other recognised an infection. Although it said the other virus scanner was only a heuristic detection.

I tried to submit the MOTA113.exe file to both but Avast went mental with the warning things and I clicked 'no action' which subsequently resulted in Avast preventing me from uploading them.

In an ironic way I am glad that others have got this message - as it strengthens the possibility that it will be a false positive. Purely for the reason that if everyone reports the same infection at the same time!!

Hope this will be a false positive and hope it will be corrected in the next VPS.

Avastfan1

You're not alone.  I just got the same thing.  I scan every night before going to bed.  This popped up last night for me.  Also, I looked at the file's date was in 2005.  Super is a known false positive.
Logged

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33897
  • malware fighter
Re: AVAST-Message: Worm MOTA113.exe
« Reply #22 on: February 23, 2009, 08:17:52 PM »
Hi posters in this thread,

As the find is generic, that means the flagging is because of a find of generic malware-like characteristics, and it is flagged by 5 scanners at virustotal.com it would be a coincidence that all av products flagged the same FP, it would hold this in quarantine for the time being,
SAS flagged this file December of last year, and the discussion then went along the following lines:
Quote
If this is associated with the file Windows\MOTA113.EXE, I am FAIRLY sure AT THIS POINT that it is also a false positive. I am keeping up with the SAS discussion forum on this topic.

I have quarantined the file MOTA113.EXE and have seen no different behavior from my computer -- but I am ready to restore the file if the folks at SAS determine that it is actually a FP.
You could do a full SAS scan and see if it flags it: http://www.superantispyware.com/superantispywarefreevspro.html

polonus

Logged
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Avastfan1

  • Guest
Re: AVAST-Message: Worm MOTA113.exe
« Reply #23 on: February 24, 2009, 04:59:46 PM »
False positive has now been confirmed.

Fixed with the latest VPS update - 090224-0.

Thanks Avast!!!
Logged

Offline Maxx_original

  • Moderator
  • Super Poster
  • *
  • Posts: 1479
Re: AVAST-Message: Worm MOTA113.exe
« Reply #24 on: February 24, 2009, 07:21:45 PM »
anyway, it is not good to pack legit software under three layers (1× PECompact and 2× tElock) ::)
Logged

Avastfan1

  • Guest
Re: AVAST-Message: Worm MOTA113.exe
« Reply #25 on: February 24, 2009, 08:57:38 PM »
Hello Maxx_Original,

Thank you for your response. I'm not sure if you are an Avast employee. I am extremely satisfied with Avast Anti-virus.

Could you possibly elaborate on the tElock layer a little? I remember seeing that word in the false positive.

Unfortunately I am not that up to speed with computers.

Thanks for your time.

Avastfan1
Logged

Offline Maxx_original

  • Moderator
  • Super Poster
  • *
  • Posts: 1479
Re: AVAST-Message: Worm MOTA113.exe
« Reply #26 on: February 25, 2009, 10:04:08 AM »
bullseye, i'm the member of avast viruslab..

tElock is a PE packer+protector written by one of the greatest scene rockers - tHE EGOiSTE (tE!) from TMG - more than 9 years ago.. it was publicly available for download (there were also some private versions) and offered a high level of protection for those users, which were not able to protect their applications with own scheme... also malware authors noticed the strength of tElock protection and started to using it to hide their nasty work.. tElock itself is not malicious (even when some AV engines detect it as malware packer), but i can't see any reason to pack legit software in multiple layers (one strong is enough imho) and i consider these files as potentially riskful (off course when i have no relation to the source of the file)..

this link http://en.wikipedia.org/wiki/Executable_compression could give you some general informations..
Logged
Pages: 1 [2]   Go Up
« previous next »