QuickTime_Update_KB[ramdom numbers].exe not caught by Avast

[AlienBB]

http://www.virustotal.com/analisis/b1551abed373edb5a3aa2358242e7d032165b188fe8f23e1d7280c30869debf0-1267323271

The computer that is infected is not connected to the Internet at the moment.

[DavidR]

What avast version are you using 4.8 or 5.0 ?


Send the sample to virus (at) avast (dot) com zipped and password protected with the password in email body, a link to this topic might help and false positive/undetected malware in the subject.

Or

If 5.0 - Open the chest and right click on the file and select 'Submit to virus lab...' complete the form and submit, the file will be uploaded during the next update.

If 4.8 - Add the file to the User Files (File, Add) section of the avast chest where it can do no harm and send it from there. A copy of the file/s will remain in the original location, so you will need to take further action and can remove/rename that.
 
Send it from the User Files section of the chest (select the file, right click, email to Alwil Software). It will be uploaded (not actually emailed) to avast when the next avast auto (or manual) update is done.

[Wizho]

http://www.virustotal.com/analisis/b1551abed373edb5a3aa2358242e7d032165b188fe8f23e1d7280c30869debf0-1267323271

The computer that is infected is not connected to the Internet at the moment.

Since you uploaded the file to VirusTotal, the sample has been sent to the Avast virus labs, still, it is advised to send the sample to the labs the way DavidR described.

[AlienBB]

I don't always have time to transfer files to my computer to email them.

Avast doesn't catch them, so they aren't in the chest.

I usually check with VirusTotal first, and was hoping that Avast would be able to get the samples from there. The file was uploaded by someone else on Feb 16, and Avast didn't catch it 12 days later.

I suspect that this file is the one that infected the computer with a rootkit.

I clean up a lot of malware infested computers and would be more apt to send samples if the process was easier. Sending the VT link would be easy enough if that would work.