Generic Detection

Threat description

Details

Category: Malware
Type: Other
Platform: W32

Summary

A Generic Detection has identified a program or file that has features or behaviors similar to known harmful programs, such as trojans, backdoors or exploits.



Removal

Automatic action

Depending on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the suspect file, or ask you for a desired action.

If you suspect that a file contains harmful code, or that a program is performing harmful actions, you can send a sample of it to F-Secure Labs for analysis:

You may also refer to the following articles for more information:

Or Contact Support for further assistance.

Security programs will sometimes unintentionally identify a clean program or file as malicious if its code or behavior is similar to a known harmful program or file. This is known as a False Alarm or False Positive (FP).

For example, 'tmp.edb' and other '.edb' files stored at the location 'C:\WINDOWS\SoftwareDistribution\DataStore\Logs\' may be unintentionally detected as malicious by various security programs.

Checking for a fix

In most cases, a False Positive is fixed in a subsequent database release; updating your F-Secure security product to use the latest database is enough to resolve the issue. If you suspect a detected file may be a False Positive, you can check by first updating your F-Secure security product to use the latest detection database updates, then rescanning the suspect file.

Send a sample to F-Secure Labs

After checking, if you believe the file or program is still incorrectly detected, you can submit a sample of it to F-Secure Labs for analysis and correction:

Exclude a known safe file from further scanning

If you are positive that the suspect file is safe and you want to continue using it, you can exclude it from further scanning by the F-Secure security product:

You may also refer to the Knowledge Base on the F-Secure Community site for more assistance.

Also

Microsoft provides enterprise-level instructions for excluding files from scanning by antivirus software:

More scanning & removal options

More information on the scanning and removal options available in your F-Secure product can be found in the Help Center.

You may also refer to the Knowledge Base on the F-Secure Community site for more assistance.

Contact Support

F-Secure customers may request support online via the Request support or the Chat forms on our Home - Global site.



Technical Details

A Generic Detection has identified a program or file that has behaviors or characteristics similar to known malware. This may indicate that either the file itself is harmful, or that it was altered by an infection present on the system.

About Generic Detections

Generic Detections are a type of detection used by antivirus programs to identify files with malicious characteristics.

Unlike single-file detections which can only identify unique files, Generic Detections can look for broadly similar code or behavioral patterns in dozens or even hundreds of suspect programs or files, to efficiently determine their potential for causing harm.

Generic Detections can be used to identify certain types of malware based on similarities in their code or behavior (for example, performing similar actions):

Generic Detections can also be used to identify groups or families of malware:

Crack files

Generic Detections using the name format "Generic.malware.[variant]", "Suspicious:w32/malware.[variant]!online" or similar may also occasionally detect a crack file, which is used to bypass the protection mechanisms of recently released games and other popular applications.

While not strictly malicious, in some countries such files may be considered illegal. In addition, such files may be distributed bundled together with other unsolicited or outrightly malicious files.

Temporary Exchange Database (.EDB) files

Temporary mailbox data files that use the .EDB file extension and are stored at the 'C:\WINDOWS\SoftwareDistribution\DataStore\Logs\' location (they would typically be named 'tmp.edb' or similar) may be unintentionally detected by various security programs from time to time if they behave in a similar manner to known malware.

To exclude a file you are certain is legitimate from further scanning and detection, refer to the instructions under Suspect a file is incorrectly detected (a False Positive)? above in the Removal section.






SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Sample

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More