AVG Findings: False/Positive???

Geekgirl · 07-12-2007, 03:58 PM

An Avg scan has found Trojan horse SHeur.AFJ in quickbooks. I find this may be a false/positive can someone elaborate? No hits in Google at all.

**kinbard** · 07-12-2007, 04:27 PM

I'm not an expert, but I find no mention of this on ca, or anything even close.

**Glaswegian** · 07-12-2007, 04:30 PM

TJ, I find it hard to believe there's a trojan within Quickbooks. Try flinging a couple of those files at Jotti or VirusTotal and see if they come up with anything. A second opinion is definitely required.

Geekgirl · 07-12-2007, 04:58 PM

The thing is, in my Quickbooks, the data1.cab file is there, and its a zip file

jonburt · 07-13-2007, 06:38 PM

This is a false positive. The latest virus def 269.10.5.899 from AVG resolve the problem. If you have removed the files, your QuickBooks will still work (the files are for the online tutorial). You can use the add/remove control panel to "repair" your install to get the files back if you or AVG deleted them.

Jon
Sr. Manager
Intuit Inc

Geekgirl · 07-14-2007, 08:04 AM

Thank you Jon for taking time to reply to this thread. I was almost positive this was a false/positive in the beginning and advised the user to not remove the files and that an AVG update may resolve the issue.
I guess I was correct all along. Thank you for the reassurance and your time

treetoppings · 07-25-2007, 03:01 PM

My Ag found the same "trojan horse" in google updater. Once it was removed it found it again in outlook express, claiming to be a backup file.

Edit: Mine is SHeur.JH, so I guess its not quite the same thing

Rascaljay · 09-19-2007, 07:57 PM

Ironically, my avg found the same "trojan horse" on 7-14, two days after your scan. The only hit I came up with was this forum! It was informative though.

Thanks.

07-12-2007, 03:58 PM	#1 (permalink)
Geekgirl Assistant Manager, Microsoft Support Join Date: Jan 2005 Location: Six-burgh, Pennsylvania Posts: 14,113 OS: 98SE/WinXP Home/WinXP Pro/Vista/Windows 7	AVG Findings: False/Positive??? An Avg scan has found Trojan horse SHeur.AFJ in quickbooks. I find this may be a false/positive can someone elaborate? No hits in Google at all. __________________ Compare NOD32 to your current antivirus and anti-spyware solution, HERE How to back up and restore the registry in Windows XP and Windows Vista Or Windows 7 How to back up and restore the registry in Windows 98/ ME / NT 4.0 / 2000 I DO NOT ACCEPT EMAILS AND WILL NOT REPLY TO THEM !!!!! TSF DOES NOT SUPPORT ASSISTANCE THROUGH EMAIL OR PRIVATE MESSAGES, PLEASE KEEP ALL QUESTIONS IN THE OPEN FORUM *The Pittsburgh Steelers - 6 X Superbowl Champions !!!!!!!* *The Pittsburgh Penguins - 2009 Stanley Cup Champions !!!!!!!*

07-12-2007, 04:27 PM	#2 (permalink)
kinbard TSF Enthusiast Join Date: Jun 2006 Location: Texas Posts: 3,459 OS: Experimenter	Re: AVG Findings: False/Positive??? I'm not an expert, but I find no mention of this on ca, or anything even close. __________________ Half viking, half pirate, stronger than both XP Repair Malware Removal Vista Repair Downgrade Vista

07-12-2007, 04:30 PM	#3 (permalink)
Glaswegian Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic Join Date: Sep 2005 Location: Glasgow Posts: 25,119 OS: Win XP Pro SP3 / Win 7 Pro My System Blog Entries: 10	Re: AVG Findings: False/Positive??? TJ, I find it hard to believe there's a trojan within Quickbooks. Try flinging a couple of those files at Jotti or VirusTotal and see if they come up with anything. A second opinion is definitely required. __________________ Iain - Defender of the Haggis and all things Scottish. I don't help by PM - post in the Forums. PC Safety & Security::PC running a bit slow?::Donate::Photographers Corner

07-12-2007, 04:58 PM	#4 (permalink)
Geekgirl Assistant Manager, Microsoft Support Join Date: Jan 2005 Location: Six-burgh, Pennsylvania Posts: 14,113 OS: 98SE/WinXP Home/WinXP Pro/Vista/Windows 7	Re: AVG Findings: False/Positive??? The thing is, in my Quickbooks, the data1.cab file is there, and its a zip file __________________ Compare NOD32 to your current antivirus and anti-spyware solution, HERE How to back up and restore the registry in Windows XP and Windows Vista Or Windows 7 How to back up and restore the registry in Windows 98/ ME / NT 4.0 / 2000 I DO NOT ACCEPT EMAILS AND WILL NOT REPLY TO THEM !!!!! TSF DOES NOT SUPPORT ASSISTANCE THROUGH EMAIL OR PRIVATE MESSAGES, PLEASE KEEP ALL QUESTIONS IN THE OPEN FORUM *The Pittsburgh Steelers - 6 X Superbowl Champions !!!!!!!* *The Pittsburgh Penguins - 2009 Stanley Cup Champions !!!!!!!*

07-13-2007, 06:38 PM	#5 (permalink)
jonburt Registered User Join Date: Jul 2007 Posts: 1 OS: XP	Re: AVG Findings: False/Positive??? This is a false positive. The latest virus def 269.10.5.899 from AVG resolve the problem. If you have removed the files, your QuickBooks will still work (the files are for the online tutorial). You can use the add/remove control panel to "repair" your install to get the files back if you or AVG deleted them. Jon Sr. Manager Intuit Inc

07-14-2007, 08:04 AM	#6 (permalink)
Geekgirl Assistant Manager, Microsoft Support Join Date: Jan 2005 Location: Six-burgh, Pennsylvania Posts: 14,113 OS: 98SE/WinXP Home/WinXP Pro/Vista/Windows 7	Re: AVG Findings: False/Positive??? Thank you Jon for taking time to reply to this thread. I was almost positive this was a false/positive in the beginning and advised the user to not remove the files and that an AVG update may resolve the issue. I guess I was correct all along. Thank you for the reassurance and your time __________________ Compare NOD32 to your current antivirus and anti-spyware solution, HERE How to back up and restore the registry in Windows XP and Windows Vista Or Windows 7 How to back up and restore the registry in Windows 98/ ME / NT 4.0 / 2000 I DO NOT ACCEPT EMAILS AND WILL NOT REPLY TO THEM !!!!! TSF DOES NOT SUPPORT ASSISTANCE THROUGH EMAIL OR PRIVATE MESSAGES, PLEASE KEEP ALL QUESTIONS IN THE OPEN FORUM *The Pittsburgh Steelers - 6 X Superbowl Champions !!!!!!!* *The Pittsburgh Penguins - 2009 Stanley Cup Champions !!!!!!!*

07-25-2007, 03:01 PM	#7 (permalink)
treetoppings Registered User Join Date: Jul 2007 Posts: 1 OS: WINDOWS ME?	Re: AVG Findings: False/Positive??? My Ag found the same "trojan horse" in google updater. Once it was removed it found it again in outlook express, claiming to be a backup file. Edit: Mine is SHeur.JH, so I guess its not quite the same thing Last edited by treetoppings; 07-25-2007 at 03:04 PM.

09-19-2007, 07:57 PM	#8 (permalink)
Rascaljay Registered User Join Date: Sep 2007 Posts: 1 OS: XP	Re: AVG Findings: False/Positive??? Ironically, my avg found the same "trojan horse" on 7-14, two days after your scan. The only hit I came up with was this forum! It was informative though. Thanks.