Author Topic: Avast for Mac indicates malware in virtual Windows VMs  (Read 2710 times)

0 Members and 1 Guest are viewing this topic.

Offline psfblair

  • Newbie
  • *
  • Posts: 2
Avast for Mac indicates malware in virtual Windows VMs
« on: October 31, 2012, 08:53:00 PM »
This is related to a previous thread ("Avast for Mac detects malware in Parallels Windows environments (maybe)") but I'm starting a new thread here since it may be a more general problem. I have a Mac OS 10.7.5 machine which also runs Windows 7 in a VMWare Fusion 4.1.3 virtual machine. The Windows 7 installation runs Microsoft Security Essentials and is supposedly clean. However, when I run Avast! Free on the Mac, I get:

      <dict>
         <key>Info</key>
         <string>Marburg/Segi</string>
         <key>Path</key>
         <string>/[path]/Virtual Machines.localized/Windows 7.vmwarevm/Windows 787cf7c29.vmem</string>
         <key>Result</key>
         <string>Infection</string>
      </dict>
      <dict>
         <key>Info</key>
         <string>Win32:FakeAlert-GY [Trj]</string>
         <key>Path</key>
         <string>/[path]/Virtual Machines.localized/Windows 7.vmwarevm/Windows 7.vmem</string>
         <key>Result</key>
         <string>Infection</string>
      </dict>

There is a second VM which is also signaled as being infected with Win32:FakeAlert-GY [Trj].

Is there any way for me to tell if this is a false positive?

Offline .: Mac :.

  • Avast √úberevangelist
  • Ultra Poster
  • *****
  • Posts: 5092
Re: Avast for Mac indicates malware in virtual Windows VMs
« Reply #1 on: November 02, 2012, 12:41:52 PM »
Since you cant disinfect the fakealert trojan from the OS X side (Deleting it would likely delete the entire VM ) try running Avast or some other scanner of the Windows Virtual machine to see if any infection is found. It is possible it was something missed my MSE.
"People who are really serious about software should make their own hardware." - Alan Kay