an unknown file discovered by NAV

Hi all ,

After a total scan by NAV,it found a file C:\x.cab which has a virus or a trojan and couldnt be quarantined, knowing that it is created since November 2004 .
Is there any possibilty to know the function of this file or if it is necessary before deleting it manually ? or shall i use another program ?

Thank you very much .

 

Hi Hankach !
Submit it to Jotti please.
This could be a false-positive.
What is the name of this malware ?

Regards,
M.J.

 

Hi Mack,

It is just like this C:\x.cab

who is Jotti and how to proceed pls .

Thank you much

 

Upload the file here http://virusscan.jotti.org/

 

i did a scan and i got the following :
File: x.cab
Status: INFECTED/MALWARE
MD5 fce065dcafae56397c12355184638a3e
Packers detected: -
Scanner results
AntiVir Found Trojan/Spam.AvaFX
ArcaVir Found Trojan.Clicker.Agent.Ac

 

It's a Trojan Clicker:-

http://www.viruslist.com/en/virusesdescribed?chapter=152540521#clickers

http://securityresponse.symantec.com/avcenter/venc/data/trojan.a.d.clicker.html

Were no other scanners finding it?

You could try uploading the file here for confirmation:-

http://www.kaspersky.com/remoteviruschk.html

You could also do an online trojan scan with ewido:-
http://www.ewido.net/en/onlinescan/run/

However you haven't given the file path, so we don't know whereabouts it is on your computer. Since it is in a .CAB archive file, a scanner is unlikely to deal with it, you would have to delete the whole archive. Unless you fancy opening it in Notepad an editing out the bad bit!

 

it is in C:\x.cab

 

NAV is finding it as a virus but cant quarantine it how to do shall i simply delete it?

 

That was quick I hadn't even finished!

If it is confirmed bad, I would just delete the whole file. I believe AVs will only quarantine files under a certain size - how big is this one?

Edit - Maybe it won't quarantine it 'cos it is in an archive? Malware in an archive is totally safe; it can only cause a problem if it is extracted from the archive.

 

it has 21,5 Kb and it is a zip archive indeed.when clicking on properties it shows type of file Cab archive and opens with quick zip .
How to delete such a file simply by deleting it manually ? i am afraid not to have other roots somewhere?

 

the malware is likely compressed inside and hasnt spread so id just delete the archive then rerun a scan with ur antivirus and maybe another online scanner too.

 

I have deleted it manaually and did a scan . it disappeared .thank you all .