Glock Talk

Glock Talk (http://glocktalk.com/forums/index.php)
-   Tech Talk (http://glocktalk.com/forums/forumdisplay.php?f=86)
-   -   Possible virus / malware: wrongInf (http://glocktalk.com/forums/showthread.php?t=1445521)

Tvov 09-30-2012 14:10

Possible virus / malware: wrongInf
 
Hello all,
My son's computer was running a bit slow. He did a boot scan using Avast free version, and it came up with one "positive":

Win32: wrongInf-D [susp]

We can't tell if this is a real problem or a false positive. He uses Windows Vista 64bit. Anyone know what this is, and if we have to worry about it?

Thanks!

GlockFanWA 09-30-2012 15:14

try running Malwarebytes and of course your son isn't running as Administrator and didn't disable UAC? What is being used for real time virus checking?

GIockGuy24 09-30-2012 15:39

That one does seem to be a false positive with Avast. It is the Install Shield engine. It can be reinstalled if removed.

I think this is the right down to reinstall it, if needed.

http://support.installshield.com/kb/...rnelUpdate.exe


Some information here.

http://consumerdocs.installshield.co...8322&sliceId=1

I would only reinstall it if it removed it with Avast.

Tvov 09-30-2012 15:57

We did run Malewarebytes with a full scan, it says the computer is fine.

GIockGuy24, thank you for the links, but do you have any that describe what "wrongInf" actually is?

On another site someone said they thought it was a trojan, and should be removed.

GIockGuy24 09-30-2012 16:49

On the Avast forum (some in German language) it looks to be a fairly common false positive with Avast. Having Avast remove it will disable the Install Shield. If you want to try removing it, you should be able to reinstall a known good version but it does seem to be a false positive.

Tvov 09-30-2012 16:49

Oh, I just remembered: When my son clicked on the Avast option to "move to chest" for the file, it came back with with an Error (I forget the details).

I'll see if he wrote it down.

Tvov 09-30-2012 16:50

Quote:

Originally Posted by GIockGuy24 (Post 19471984)
On the Avast forum (some in German language) it looks to be a fairly common false positive with Avast. Having Avast remove it will disable the Install Shield. If you want to try removing it, you should be able to reinstall a known good version but it does seem to be a false positive.

Thanks! It was weird looking up info on that, as many links went to German language sites.

Tvov 09-30-2012 18:42

GIockGuy24, according to McAfee, it is a virus that McAfee sees as "W32/Xpaj.b!43F2805C2C15". Avast recognizes it as "Win32:WrongInf-A [Susp]".

From this link:

http://home.mcafee.com/virusinfo/vir...ey=980823#none

Oh, the difference is we have "-D" instead of "A".
Now I'm not sure what to do?

GIockGuy24 09-30-2012 19:48

Well you could have Avast try to remove it. Then you can try to reinstall the Install Shield from Microsoft. It may still come up as a false positive or Avast may try to prevent installing it.

GIockGuy24 09-30-2012 19:52

Here is the McAfee Stinger program.

http://majorgeeks.com/McAfee_Stinger_d4063.html

You could run it and see if anything comes up.

Sgt. Schultz 10-01-2012 21:21

Quote:

Originally Posted by Tvov (Post 19471844)
We did run Malewarebytes with a full scan, it says the computer is fine.

Did you run the scan in safe mode?


Try scanning with this ...

http://www.superantispyware.com/port...annertech.html

... in safe mode.

Tvov 10-02-2012 05:02

I am not sure if he ran Malewarebytes in safe mode, I know he ran Avast in safe mode.

It is looking like it was a false positive. I didn't realize that he ran Avast with everything turned to "high" ("heuristics" or something) so it was saying all sorts of stuff was possible problems.

Last night the computer seemed fine, and the various anti-virus scans he did on "normal" settings all came through okay. My son is paranoid about his computer getting infected, so whenever anything seems odd he gets all worked up.

Thanks for the responses!


All times are GMT -6. The time now is 10:03.

Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2014, vBulletin Solutions, Inc.
Copyright 2013, Glock Talk, All Rights Reserved.