Trojan Horse Generic6.UMU false positive with AVG. Now solved.

Status
Not open for further replies.

raybay

Posts: 6,906   +10
We are seeing a great number of our clients with a reported infestation of Trojan Horse Generic6.UMU.
We believe this is a false positive, declared by AVG, and so far no other Antispyware or Antivirus detection software. Perfectly clean machines are reporting as many as six investations when their AVG runs automatically in the morning.
Has anyone seen an infestion of this "Trojan" reported by any other infestation detection software?
 
Nice info raybay.

I have slightly altered your thread title and moved it to our Security and the Web forum.

I have also temporarily stickied the thread, until Grisoft sort this problem out. Hopefully, that won`t take too long.

Regards Howard :)
 
HERE is some useful info, if you suspect a false positive with AVG.

BIG AL 43 said:
All Users

Just to make sure that you are fully aware this forum is only manned by other AVG Free users... we don't work for Grisoft. All moderators of this forum are volunteers and contribute their time freely.... On the AVG Free forum this is the only way to deal with false positives....

Please try to update your AVG Free Edition and run the AVG Free Edition Complete Test again. If you suspect a file to be a false positive. Test the file at [virusscan.jotti.org] and if it is a false positive, archive (zip, arc, tar etc) the file using a password and email a copy to virus@grisoft.com with a brief description as well as the password you used to archive it with.

If it is a false positive , turn off hueristic scanning for the time being. When Grisoft adjusts the virus defintions you can turn it back on. If turning off Hueristics still doesn't allow access to the file while testing and emailing... disable the resident shield temporarily but remember to re-enable it afterwards.

TIP This may be req'd. with Win Vista OS... From the Windows menu... locate the AVG Control Center icon and right click on it then select Run As Administrator... disable the Resident Shield and then complete the rest of the above instructions.

USER REF. INFO. To create an archive and password it you would need a utilty that supports doing that... its pretty easy to do but we don't give lessons per se... but a free and good archive program is called 7-Zip and can be found here [www.7-zip.org] ... this program can make many archive types but we'd suggest using ZIP since most people can open that type up.. refer to its documention for instructions on use.

Regards Howard :)
 
Hi!

I'm new here. My AVG took 6 legitimate program files that came with my computer, declared them infected with generic6.umu and put them in the vault. Now I have to go rescue them, I'm hoping they'll be okay still. AVG is also continually considering cookies as viruses. Is it okay to just restore that stuff from the vault? I try and clear out cookies before scans to avoid having 71 "viruses."
 
AVG has confirmed false positive, and corrected it. For generic6.umu, you will have no trouble restoring anything. Since many of our clients use AVG, we have been very busy verifying no permanent damage was done.
The problem lasted for less than a day.
 
Cheers for the info raybay. I will leave this thread stickied for the next few days, after which I`ll unstick it.

Regards Howard :)
 
raybay said:
AVG has confirmed false positive, and corrected it. For generic6.umu, you will have no trouble restoring anything. Since many of our clients use AVG, we have been very busy verifying no permanent damage was done.
The problem lasted for less than a day.


Nope. As of 9/14/07, both the UMS and UMU variant were reported by AVG free in the scan for 9/16/07 in the backup copy of the setup code for the new vista driver for Nvidia graphic boards. I downloaded the driver from the Nvidia web site, so I doubt that it really has trojans.
 
Status
Not open for further replies.
Back