« previous next »
Pages: [1]   Go Down

Author Topic: W97M_ETHAN.C  (Read 4163 times)

0 Members and 1 Guest are viewing this topic.

phillbex

  • Guest
W97M_ETHAN.C
« on: February 14, 2007, 01:15:13 PM »
Hi,

We have found that some of our word docs are infected with the W97M_ETHAN.C virus but Avast does not find it. Any idea as to how I can change this?

Phill
Logged

mauserme

  • Guest
Re: W97M_ETHAN.C
« Reply #1 on: February 14, 2007, 01:27:11 PM »
Hi Phil.  Welcome to the forum.

Is that a Trend Micro detection?  I assume you've run Housecall and hopefully haven't deleted all the infected files yet.  If you still have them you could upload samples to Jotti to confirm the infection and, if confirmed,  send a password protected, compressed sample to virus@avast.com.  Make sure to include the password in the email - something simple like "virus" is fine.

http://virusscan.jotti.org/
Logged

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89051
  • No support PMs thanks
Re: W97M_ETHAN.C
« Reply #2 on: February 14, 2007, 03:19:22 PM »
You could also check the offending/suspect file at: VirusTotal - Multi engine on-line virus scanner, this I feel is a better scanning option as it uses the windows version of avast (more packers) and has more scanning engines 29 at the last count.

avast should see this as MW97:Ethan family.
Logged
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.3.6108 (build 24.3.8975.762) UI 1.0.801/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33900
  • malware fighter
Re: W97M_ETHAN.C
« Reply #3 on: February 15, 2007, 08:03:47 AM »
Hi philbex,

Also consider these removal instructions for this macro-virus:
http://service1.symantec.com/sarc/sarc.nsf/html/W97M.Ethan.A.html

polonus
Logged
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

together

  • Guest
Re: W97M_ETHAN.C
« Reply #4 on: March 15, 2007, 03:32:16 PM »
If its worth anything, our corp avast setup refuses to detect this at all points (email, server, desktop). I did email about it many months ago without response.

If you want another sample, I can forward to an appropriate contact.
Logged

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 89051
  • No support PMs thanks
Re: W97M_ETHAN.C
« Reply #5 on: March 15, 2007, 05:26:51 PM »
I assume you sent it to virus @ avast.com without the spaces. It can get very crowded in there as 4000+ emails per day are received. If you have a sample in the avast chest (you can add it to the User Files section of the chest) and send it from there that gets filtered on receipt so I feel that is a better way.

OR You can use the ftp server to upload the files. Upload them to ftp://ftp.avast.com/incoming - Connect to the link and drag the file into the Right pane and drop it, that starts the upload, you don't have read access to this folder.
Logged
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.3.6108 (build 24.3.8975.762) UI 1.0.801/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67194
Re: W97M_ETHAN.C
« Reply #6 on: March 15, 2007, 06:39:07 PM »
Quote from: together on March 15, 2007, 03:32:16 PM
I did email about it many months ago without response.
Where is the better and faster detection method that you're always promising to us?
Logged
The best things in life are free.
Pages: [1]   Go Up
« previous next »