Heuristic

Threat description

Details

CATEGORYMalware
TYPEOther

Summary

A heuristic detection has identified a file with behavior or code characteristics that resemble known malware. This may indicate that either the file itself is harmful, or that it was altered by an infection present on the system.



Removal

Flagged as Suspicious

If a file contains potentially damaging routines or suspicious code, F-Secure security products will flag it as Suspicious as a precautionary measure.

For more information, see: F-Secure Community Knowledge Base: Automatic actions for viruses also used for suspicious items.

Security programs will sometimes unintentionally identify a clean program or file as malicious if its code or behavior is similar to a known harmful program or file. This is known as a False Alarm or False Positive (FP).

For example, 'tmp.edb' and other '.edb' files stored at the location 'C:\WINDOWS\SoftwareDistribution\DataStore\Logs\' may be unintentionally detected as malicious by various security programs.

Checking for a fix

In most cases, a False Positive is fixed in a subsequent database release; updating your F-Secure security product to use the latest database is enough to resolve the issue. If you suspect a detected file may be a False Positive, you can check by first updating your F-Secure security product to use the latest detection database updates, then rescanning the suspect file.

Send a sample to F-Secure Labs

After checking, if you believe the file or program is still incorrectly detected, you can submit a sample of it to F-Secure Labs for analysis and correction:

Exclude a known safe file from further scanning

If you are positive that the suspect file is safe and you want to continue using it, you can exclude it from further scanning by the F-Secure security product:

You may also refer to the Knowledge Base on the F-Secure Community site for more assistance.

Also

Microsoft provides enterprise-level instructions for excluding files from scanning by antivirus software:

Technical Details

F-Secure security programs include heuristic engines that perform extended file analysis during a system scan in order to identify suspicious, malware-like code or potentially harmful routines. Actual detection names used by the heuristic engines may vary, and include:

Possibly Infected With an Unknown Virus, Saattaa olla tuntemattoman viruksen saastuttama, Possibly a mass mailing worm, Virus-like code found by heuristics, Deepscan:generic.malware, Gen:Heur, Possibly Destructive Program, New or Modified Variant Of, Viruses cannot be disinfected unless they are identified

The suspect file found on the computer system showed malicious/potentially damaging routines or characteristics.

Gen:Trojan.Heur

The suspect file contains trojan-like code or behavior.

Memscan:

After a suspect file has been emulated in a virtual environment, the virtual memory is examined for malware. If malicious code is found in the virtual memory, this detection is triggered.

Possible misdisinfected virus

The suspect document or a workbook may contain an incompletely disinfected virus.

Suspicious Win32 PE

A Windows program file contains suspicious code; this may be either a unknown virus or simply virus-like code. Please submit a sample to F-Secure Labs for further analysis.

Type_Com

The suspect file contains virus-like code resembling a COM file infector virus.

Type_ComTSR

The suspect file contains contains virus-like code resembling a memory resident COM file infector virus.

Type_Exe

The suspect file contains contains virus-like code resembling an EXE file infector virus.

Type_ExeTSR

The suspect file contains contains virus-like code resembling a memory-resident EXE file infector virus.

Type_ComExe

The suspect file contains contains virus-like code resembling a file infector virus that may affect COM and EXE files.

Type_ComExeTSR

The suspect file contains contains virus-like code resembling a memory-resident file infector virus that may affect both/either COM and EXE files.

Type_Boot

The suspect file contains contains virus-like code resembling a BOOT sector infector virus. .

Type_Trojan

Found trojan-like code in file or boot record.

Type_Win32

Found virus-like code resembling a Windows 95/98/NT EXE file infector virus.

Type_Formula

A Microsoft Excel sheet containing a 'CALL' instruction was found. This relates to a known security vulnerability. Further information is available from Microsoft: http://www.microsoft.com/technet/security/bulletin/ms98-018.asp.

Type_RemoteTemplate

A Microsoft Word document containing a reference to a remote template (i.e., not in the local machine) was found. This relates to a known security vulnerability. Further information is available from Microsoft: http://www.microsoft.com/technet/security/bulletin/ms99-002.asp.

Type_Script

A suspicious fragment in a program written with a scripting language (e.g., JavaScript or Visual Basic Script) was found. This relates to a known security vulnerability. Further information is available from Microsoft: http://www.microsoft.com/technet/security/bulletin/ms99-002.asp.

JS.ActiveXComponent

A HTML page containing references to a known vulnerability in the Internet Explorer web browser was found. Further information, including a fix, is available from Microsoft: http://www.microsoft.com/technet/security/bulletin/ms00-075.asp.

HTML.SecurityBreach.2 HTML.SecurityBreach.3

A suspicious reference to a script object has been found. Further information about the vulnerability is available from Microsoft: http://www.microsoft.com/technet/security/bulletin/ms99-032.asp.

Submit a Sample

Suspect a file or URL was wrongly detected?
Send it to our Labs for further analysis

Submit a Sample

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

More Info