Is there really a virus in this file?

[David_Jones]

Hi All,

First of all, please, please, please take care if you are downloading the zip file attached to this message - it MAY contain a worm or virus of some sort.

My actual question is whether the files really do contain the Worm\Happy.C and VBS\Newlove.A as reported by AVGuard for Windows 9x Personal Edition.

I updated to the latest version, but for the record I have:

Program: 6.15.08.58
Scan Engine: 6.15.00.01
VDF File: 6.15.00.63

AVGuard reported that my wsock32.dll file in C:\Windows\System had been destroyed by the Worm\Happy.C

It also reported that a file called imscan.dll in C:\Windows\System\Activescan had been destroyed by the VBS\Newlove.A

Of course, I had no reason to doubt this, so I opted to delete the DLL and restored it using SFC from the CABS, and removed the entire Activescan directory (see note below regarding this folder).

I also checked out the viruses / worms on various sites, and checked for the other indicators, none of which I seem to have.

However, AVGuard is continuing to report that both files are infected.

I then checked it out with Pandasoft online checker (http://www.pandasoftware.com/activescan/com/) and Housecall (http://housecall.antivirus.com/).

Neither of these could find any indication that there is a problem.


Can anyone help to confirm that there is or is not a problem in either of the files? I have attached the wsock32.dll file within a single zip file, which I hope will make it safe to download for others. Unfortunately, the imscan.dll is 1,104kb unzipped, and just under half that size zipped, so I cannot attach it here due to the size restriction. However, I am more than happy to email it to anyone (in zipped form) if you want to see it for yourself.

WARNING: PLEASE BE CAREFUL WITH THE ATTACHMENT. IF YOU AREN'T SURE WHAT YOU ARE DOING, I SUGGEST YOU LEAVE IT ALONE, SINCE I DO NOT KNOW WHAT DAMAGE, IF ANY, YOU COULD DO EVEN BY DOWNLOADING THE ZIP FILE.

Thanks in advance for any help you can provide,

David.


NB: The activescan folder is created by Pandasoft's online checker - I removed it, and the entry in "Downloaded Program Files", plus all references to it in the registry, and then let it re-install from the website when it did the online virus check there. It worked fine after re-installing.

[Trent Steel]

I am using Norton AntiVirus 2002, it did not detect any problems.

[HAL9000]

Nothing that I can find.

As a side note for future reference. Please do not post attachments which you believe may be infected with a virus. While you did post a warning, it's something that may not be in the best intrest of other users and this message board. If you need somebody else to do a scan, offer to e-mail it to them (at thier own risk of course).

[David_Jones]

Okay - thanks guys.

Noted about the attachment. Good suggestion about doing it that way.

I think I will report it back to the software company as a potential bug.