AntiWPA Forum

Full Version: Avira detection
You're currently viewing a stripped down version of our content. View the full version with proper formatting.
An avira window just popped up that says it's detected 'SPR/Tool.Ursnif.A.3' in 'winlogon.exe'. Obviously I don't want to move this file to quarantine but what is it? Is this file associated with antiwpa?
Hi,

Could be a False Positive - but to be certain submit the suspected file only via the following form:

http://analysis.avira.com/samples/

Ensure that you select the Suspected False Positive (Not Malware) under File type.

Also ensure within the URL field you put N/A.

You should then hopefully receive an email back from Avira within 48 hours telling you whether its a False Postive or not.

Let me know how that goes.
Hi
Do you mean I should send 'winlogon.exe' to them?
Thanks.
(05-06-2011 03:00 PM)mordredking Wrote: [ -> ]Hi
Do you mean I should send 'winlogon.exe' to them?
Thanks.

Yes
Ok, thanks for the help Smile
If winlogon.exe is located at %windir%\system32\ then its likely to be a false positive.
Cool, thanks.
Is there a way to get Avira to ignore it permanently? It detects it every time I boot which gets annoying.
(05-07-2011 06:27 PM)mordredking Wrote: [ -> ]Cool, thanks.
Is there a way to get Avira to ignore it permanently? It detects it every time I boot which gets annoying.

Next time it pops up take a screenshot and reply with it.
Yes Detect Trojaner
Thanks for the help.
Indeed Kaspersky detected a trojan.
Reference URL's