hidden file !readme.exe infected by Doomber.D

AntiVir found a hidden file "!readme.exe" infected by doomber on my computer.
I send it to virustotal and virusscan, only four AV report it as infected: AntirVir, Panda, Norman and Sybari (some under the name Ghostbot).
Such readme.exe files are listed in virus definitions, but not with a leading exclamation mark, and if the file is hidden there is a very little chance that somebody clicks on it.

Is it a false alarm or not?

 

There is a thread here on General Cleaning: https://www.wilderssecurity.com/showthread.php?t=50662

Hope this helps...

Let us know how you go...

Cheers

 

most of !readme.exe I've analyzed were infected by "Gobot" (better known as Ghost Bot) that's a trojan/IRC backdoor written by P0sitr0n using delphi language.

So I could tell you that's almost sure the file isn't a false positive (however if you want to be sure you can send me the file at fileanalysis@email.it )

Regards

 

sorry for the delay, I hadn't seen your e-mail

Don't worry, that's a corrupted file, not dangerous Please delete it

Best Regards

 

Thank you for this analysis.
Even if it's an harmless damaged version, it doesn't explain how it had arrived on my computer. If the creation date is correct, it was there for two months.

 

I could try to imagine how it was on your pc
For example a not completed transfer on your pc. This worm use some ways to copy itself on a pc, for example by netbios. If the transfer encountered some problems, the file copied was damaged.
Or, another example, a bad download from a peer to peer software that corrupted the file.
These are only a try to give an explanation

Regards