An avira window just popped up that says it's detected 'SPR/Tool.Ursnif.A.3' in 'winlogon.exe'. Obviously I don't want to move this file to quarantine but what is it? Is this file associated with antiwpa?
Hi,
Could be a False Positive - but to be certain submit the suspected file
only via the following form:
http://analysis.avira.com/samples/
Ensure that you select the
Suspected False Positive (Not Malware) under
File type.
Also ensure within the
URL field you put
N/A.
You should then hopefully receive an email back from Avira within 48 hours telling you whether its a False Postive or not.
Let me know how that goes.
Hi
Do you mean I should send 'winlogon.exe' to them?
Thanks.
(05-06-2011 03:00 PM)mordredking Wrote: [ -> ]Hi
Do you mean I should send 'winlogon.exe' to them?
Thanks.
Yes
Ok, thanks for the help
If winlogon.exe is located at %windir%\system32\ then its likely to be a false positive.
Cool, thanks.
Is there a way to get Avira to ignore it permanently? It detects it every time I boot which gets annoying.
(05-07-2011 06:27 PM)mordredking Wrote: [ -> ]Cool, thanks.
Is there a way to get Avira to ignore it permanently? It detects it every time I boot which gets annoying.
Next time it pops up take a screenshot and reply with it.
Thanks for the help.
Indeed Kaspersky detected a trojan.