VME family virus ?

[Zigintas]

Avast report for my "A Virus Was Found"

File name:
http://g.delfi.lt/b/f/468x60_rieker_lt_m_16-04-2007.swf
Malware name: VME family
Malware type: Virus/Worm
VPS version: 000734-0, 2007.04.16

Processing: [Abort connection]



Why problem? Banner or antivirus?

[RejZoR]

It's probably a false positive. I've already submitted it to the Alwil virus lab with describtion.
Fix for it will probably be released soon.

[polonus]

Hi Zigintas,

FP or not, the message "processing abort connection" means that malware tried to connect but connection was aborted (by you), so you were not infected.
To make sure you could download F-prot for Dos from: http://www.claymania.com/f-prot.html , and scan.
But I assume that RejZoR is right, and this is a False Positive. I had a similar thing lately also for a dinosaur DOS virus, see: http://forum.avast.com/index.php?topic=27574.0

polonus

[DavidR]

Nothing found by DrWeb link checker either so as RejZoR said probably an FP.

[DavidR]

Update, downloaded the .swf file and uploaded it to VirusTotal, scan in progress now and so fare only avast has detected it as infected. VT just failed at 23 scanners an only avast detected it, I will upload again and see if it completes, but it looks certain it is an FP, I have submitted it to avast.

As a temporary measure, you could add the path you posted to the Web Shield, Customize, Exceptions, Add. This will exclude the file from scans.

[DavidR]

Well the Jury is in at VirusTotal out of 32 scanners only avast detected it.

[polonus]

Hi posters in this thread,

Conclusion = FP.

polonus