asquared detected find.exe as trojan?

Discussion in 'other anti-trojan software' started by wutsup, Mar 25, 2010.

Thread Status:
Not open for further replies.
  1. wutsup

    wutsup Registered Member

    Joined:
    Sep 20, 2009
    Posts:
    630
    Location:
    United States
    hey wilders, i just scanned my secondary xp 32 computer with asquared free, and it said it found find.exe in system32 dllcache. is this really trojan or a false positive. isnt find.exe a legit executable from microsoft?

    what makes me think its a FP is that i scanned it again but ths time with avira free version 10's block autostat function turned off(think it was interfering with it cause avira popped up saying somethig about blocking malware from starting up)

    and it said it founnd 2 trojans in system volume restore so i just deleted them even thouhg i think they were fp's as well.....

    any thoughts? thx in advance, wutsup
     
  2. Brummelchen

    Brummelchen Registered Member

    Joined:
    Jan 3, 2009
    Posts:
    1,734
    check it here again:
    http://www.virustotal.com/de/
    if a false positive write a email to avira support.

    PS md5 hash from my "find.exe" (XP SP3 32bit)
    ce416e2e477e8dced94aab7ee97f11f5|find.exe
    (compare with the resulted hash from VT above)

    if same for sure false positive

    if really infected - setup xp from scratch or use an image (backup all important data before)
    you cannot really clean up such system - and improve security concept.
     
  3. wutsup

    wutsup Registered Member

    Joined:
    Sep 20, 2009
    Posts:
    630
    Location:
    United States
    nevermind, i just scanned again with asquared and find.exe didnt show up and those 2 other trojans were false positives.

    and that pop up frolm avira during the asquared scan was just tellikng me that it blockede an autorun.inf from the H drive which is the recovery partition on HP/compaq computers. so it was not malware, my mistake.

    where exactly is find.exe? i cant seem to find it.
     
  4. Brummelchen

    Brummelchen Registered Member

    Joined:
    Jan 3, 2009
    Posts:
    1,734
    c:\windows\system32\

    PS it's a german xp so the hash may differ to an english system - sorry :ouch:
     
  5. wutsup

    wutsup Registered Member

    Joined:
    Sep 20, 2009
    Posts:
    630
    Location:
    United States
    i cant find find.exe, all i found was findstr.exe?
     
  6. Dundertaker

    Dundertaker Registered Member

    Joined:
    Oct 17, 2009
    Posts:
    385
    Location:
    Land of the Mer Lion
  7. wutsup

    wutsup Registered Member

    Joined:
    Sep 20, 2009
    Posts:
    630
    Location:
    United States
    but id find.exe the same as findstr.exe??
     
  8. wutsup

    wutsup Registered Member

    Joined:
    Sep 20, 2009
    Posts:
    630
    Location:
    United States
    i just checked on my main vista 64bit computer and it has both find.exe and findstr.exe

    ROFL, i think my dad might of deleted the find.exe false positive......cause i started the a squared scan the night before and i guess my dad used the computer and thought it was malware since asquared said it was....

    crap what do i do now? the computer seems to work fine. is find.exe and important file??
     
  9. mvario

    mvario Registered Member

    Joined:
    Sep 16, 2008
    Posts:
    339
    Location:
    Haddonfield, IL
  10. Noob

    Noob Registered Member

    Joined:
    Nov 6, 2009
    Posts:
    6,468
    It is probably related to something like the windows search engine? :p
     
  11. mvario

    mvario Registered Member

    Joined:
    Sep 16, 2008
    Posts:
    339
    Location:
    Haddonfield, IL
    No, they're command line utilities. Not all is GUI.
     
  12. wutsup

    wutsup Registered Member

    Joined:
    Sep 20, 2009
    Posts:
    630
    Location:
    United States
    thx for the info mvario

    i guess its not that big of deal that find.exe is deleted now. as long as the computer runs fine caause its mostly just used for web browsing, and storage for pictures and microsoft word and quicken
     
Thread Status:
Not open for further replies.