Generic Detection

Summary

A Generic Detection for programs with features or behaviors indicative of known malicious threats, such as trojans, worms or viruses.

Disinfection & Removal

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.

Technical Details

A detection name that uses the format "Generic.malware.[variant]", or similar, is a Generic Detection that is triggered if the suspect file appears to be suspicious, potentially undesirable, or has characteristics that resemble known malware. This may indicate the presence of a malware infection, or that the suspect file is malicious.

Once found, either the suspect file will be automatically disinfected or the user will be prompted to select a desired action.

About Generic Detections

Generic Detections are a type of sophisticated detection used by antivirus programs to identify files with malicious characteristics.

Unlike more traditional detections (also known as signatures or single-file detections) a Generic Detection does not identify a unique or individual malicious program. Instead, a Generic Detection looks for broadly applicable code or behavior characteristics that indicate a file as potentially malicious, so that a single Generic Detection can efficiently identify dozens, or even hundreds of malware.

Generic Detections can be used to identify particular types of malware, based on general physical or behavioral characteristics:

• Virus (Generic)
• Trojan (Generic)
• Worm (Generic)

In this case, the Generic Detection does not generally specify which family the malware belongs to.

Alternatively, a Generic Detection can be targeted to identify particular malware families, based on familial similarities:

• Backdoor:W32/Pushbot.gen!A
• Trojan-Downloader:W32/Mebroot.gen!B
• Trojan:W32/Daonol.gen!C

Possible False Alarms (FAs)

Occassionally, a legitimate program or file containing code sufficiently similar to a known malware signature will inadvertently trigger a false alarm.

For example, 'tmp.edb' and other '.edb' files stored at the location 'C:\WINDOWS\SoftwareDistribution\DataStore\Logs\' may be unintentionally detected as malicious by various security programs.

If the suspect file is known to be legitimate, it may be excluded from scanning with the following instructions:

• Support Community Article 15398: How do I exclude a file or folder from scanning?

Microsoft also provides enterprise-level instructions for excluding the file in question from scanning by antivirus software:

• Microsoft Support KB 822158: Virus scanning recommendations for Enterprise computers that are running currently supported versions of Windows

Note

If in doubt, or in cases where a legitimate file is suspected to contain malicious code, please send a sample to F-Secure Security Labs via the Sample Analysis System (SAS) for analysis. You may want to refer to the following Support articles for more details:

• Support Community Article 11667: Submitting a false positive or false negative
• Support Community Article 15587: Recovering quarantined items from the quarantine folder manually
• Support Community Article 21760: Action on files that cannot be disinfected

Or Contact Support for further assistance.