Who should I believe? MBAM says file is safe

[whatmeworry?]

Recently, I put AVAST on my old IBM Thinkpad T-40 laptop running WinXP Pro. In AVAST's first scan, it claimed that it had found a trojan--Win32:Trojan-gen {Other}--in a file I have had on my computer for a long time. It's the setup file for an old version of my favorite screen-capture program, HyperSnap, a program I have used in various versions for many years. No anti-virus or anti-malware scan (including MBAM) had ever flagged this file as problematic. I have subsequently scanned the file with MBAM, SpyBot, SuperAntiSpyware, and (on a different computer) McAfee, all with the most current definitions. None of them found the file problematic. I then uploaded the file to VirusTotal. The first time, it produced only four results, mostly "suspicious file." I asked it to analyze it again, and this time 20 of 41 AV programs flagged it, mostly as a trojan.

I'm now quite confused. In the past, I have tended to find MBAM more reliable than any other program. It never flagged this file, neither in scans of the individual file nor in quick or full scans. Today, I made sure AVAST still found the file a trojan; I then ran both another MBAM individual scan of the file and an MBAM full scan, again with the most current defs, and MBAM did not flag the file. I don't know whom to believe. If it were just AVAST vs. MBAM, my money would be on MBAM as the more trustworthy, but the Virus Total results make me wonder. What should my next step be?

Thanks in advance for your help.

[nosirrah]

Some software authors use an anti reverse engineering technology called runtime unpacking . More or less this prevents anyone from simply opening the file and seeing its inner workings as the unpacked code only exists in memory . There are very aggressive forms of this technology and some forms that almost exclusively used by malware authors to obscure their code . This is where the vast majority of AV FPs come from , reading runtime packing as malicious .

I think that might be what is going on here but I need the file itself to know for sure . If it fits , please zip and attach it here and I will have a look at it . If not I will PM you my personal email so you can send it directly to me .

[whatmeworry?]

I think that might be what is going on here but I need the file itself to know for sure . If it fits , please zip and attach it here and I will have a look at it . If not I will PM you my personal email so you can send it directly to me .

Thanks VERY much, nosirrah, for your quick and helpful response. I tried to attach a zipped copy of the file with this message, but it was too large (3.15 MB). If you PM me your email address, I'll send it that way.

[nosirrah]

For a sample this size please use this link :

http://uploads.malwarebytes.org/

Use the file name FOR-BRUCE so I can pick your sample out of the pile .

[whatmeworry?]

For a sample this size please use this link :

http://uploads.malwarebytes.org/

Use the file name FOR-BRUCE so I can pick your sample out of the pile .

Thanks, Bruce. I've now uploaded the file FOR-BRUCE_HS60201Setup.zip.

[nosirrah]

This looks like a FP . I believe it is being detected by AV because it is packed with armadillo (runtime unpacker) and possibly also used by some malware to steal screen shots .

[whatmeworry?]

This looks like a FP . I believe it is being detected by AV because it is packed with armadillo (runtime unpacker) and possibly also used by some malware to steal screen shots .

Thanks so much, Bruce, for responding so quickly. I'm very pleased with what you've said. I've used various versions of HyperSnap for many years, and I found it hard to believe that one of its set-up files would carry a trojan. I found it even harder to believe because the file in question has been on my computer for quite a while, and no scan by any anti-virus or anti-malware program ever flagged it until the AVAST scan. I would blame AVAST, but I'd then also have to blame all the other AV programs that similarly flagged the file when I uploaded it to VirusTotal. These include a-squared, AntiVir, AVG, BitDefender, eSafe, Fortinet, GData, Ikarus, K7AntiVirus, 2 of the 3 versions of McAfee (but apparently not the one I use on my desktop), NOD32, Panda, Prevx, Sophos, Symantec, VBA32, ViRobot, and VirusBuster. In short, 20 of the 41 programs, including many highly regarded ones.

It does make one wonder about AV programs .

I've tried reporting this as a FP to AVAST, but subsequent definitions continue to regard the file as a trojan. I'm not sure there's anything I can do except shrug it off and find something else to worry about . I realize that all of the other AV programs I was going to switch to if I didn't like AVAST were just as mistaken on this call.

Again, many many thanks!!