[Tvov]

Hello all,
My son's computer was running a bit slow. He did a boot scan using Avast free version, and it came up with one "positive":

Win32: wrongInf-D [susp]

We can't tell if this is a real problem or a false positive. He uses Windows Vista 64bit. Anyone know what this is, and if we have to worry about it?

Thanks!

[GlockFanWA]

try running Malwarebytes and of course your son isn't running as Administrator and didn't disable UAC? What is being used for real time virus checking?

[GIockGuy24]

That one does seem to be a false positive with Avast. It is the Install Shield engine. It can be reinstalled if removed.

I think this is the right down to reinstall it, if needed.

http://support.installshield.com/kb/...rnelUpdate.exe


Some information here.

http://consumerdocs.installshield.co...8322&sliceId=1

I would only reinstall it if it removed it with Avast.

[Tvov]

We did run Malewarebytes with a full scan, it says the computer is fine.

GIockGuy24, thank you for the links, but do you have any that describe what "wrongInf" actually is?

On another site someone said they thought it was a trojan, and should be removed.

[GIockGuy24]

On the Avast forum (some in German language) it looks to be a fairly common false positive with Avast. Having Avast remove it will disable the Install Shield. If you want to try removing it, you should be able to reinstall a known good version but it does seem to be a false positive.

[Tvov]

Oh, I just remembered: When my son clicked on the Avast option to "move to chest" for the file, it came back with with an Error (I forget the details).

I'll see if he wrote it down.

[Tvov]

Originally Posted by GIockGuy24

On the Avast forum (some in German language) it looks to be a fairly common false positive with Avast. Having Avast remove it will disable the Install Shield. If you want to try removing it, you should be able to reinstall a known good version but it does seem to be a false positive.

Thanks! It was weird looking up info on that, as many links went to German language sites.

[Tvov]

GIockGuy24, according to McAfee, it is a virus that McAfee sees as "W32/Xpaj.b!43F2805C2C15". Avast recognizes it as "Win32:WrongInf-A [Susp]".

From this link:

http://home.mcafee.com/virusinfo/vir...ey=980823#none

Oh, the difference is we have "-D" instead of "A".
Now I'm not sure what to do?

[GIockGuy24]

Well you could have Avast try to remove it. Then you can try to reinstall the Install Shield from Microsoft. It may still come up as a false positive or Avast may try to prevent installing it.

[GIockGuy24]

Here is the McAfee Stinger program.

http://majorgeeks.com/McAfee_Stinger_d4063.html

You could run it and see if anything comes up.

[Sgt. Schultz]

Originally Posted by Tvov

We did run Malewarebytes with a full scan, it says the computer is fine.

Did you run the scan in safe mode?


Try scanning with this ...

http://www.superantispyware.com/port...annertech.html

... in safe mode.

[Tvov]

I am not sure if he ran Malewarebytes in safe mode, I know he ran Avast in safe mode.

It is looking like it was a false positive. I didn't realize that he ran Avast with everything turned to "high" ("heuristics" or something) so it was saying all sorts of stuff was possible problems.

Last night the computer seemed fine, and the various anti-virus scans he did on "normal" settings all came through okay. My son is paranoid about his computer getting infected, so whenever anything seems odd he gets all worked up.

Thanks for the responses!