Avira found 2 viruses named 'W95/Blumblebee.1738'

maxima2k2 · 07-01-2008, 07:21 AM

I downloaded Avira Personal Free with the most recent updates and did a scan and it found two viruses named "w95/bumblebee.1738" in these two files, "C:\Program Files\Panda Security\ActiveScan 2.0\pskavs.dll" and "C:\WINDOWS\system32\ActiveScan\pskavs.dll". I ran a complete scan at Panda, but it would take nearly a whole day and it was only at 40% with 33 instances found so I just gave up and canceled. Does it normally this this long to run a scan? Is this a real virus or false positive.

tetonbob · 07-01-2008, 08:17 AM

It is a false positive from Avira because Panda Antivirus does not encrypt its virus database. So, some scanners see the file definitions the same as infections.

Avast has the same issue, and explains it here:

http://www.avast.com/eng/virus_detec....html#idt_1554

As far as taking a long time, it depends on how large the hdd is, and how many files need be scanned.

Also, the resident AV should be disabled when performing an online scan. The resident gets jealous when the online scanner looks at files, and it wants a peek, too. This slows things down greatly.

maxima2k2 · 07-01-2008, 09:05 AM

update: Just did another Avira scan with a couple more updates and it found 3 more infected files "C:\System Volume Information\_restore{58E30938-66A1-4D08-9DCD-360CE25B3A88}\RP378\A0078420.dll", "C:\System Volume Information\_restore{58E30938-66A1-4D08-9DCD-360CE25B3A88}\RP381\A0078490.dll" and "C:\System Volume Information\_restore{58E30938-66A1-4D08-9DCD-360CE25B3A88}\RP381\A0078491.dll". All of these files were quararentined. Thanks

07-01-2008, 07:21 AM	#1 (permalink)
maxima2k2 Registered User Join Date: Feb 2007 Posts: 59 OS: win xp	Avira found 2 viruses named 'W95/Blumblebee.1738' I downloaded Avira Personal Free with the most recent updates and did a scan and it found two viruses named "w95/bumblebee.1738" in these two files, "C:\Program Files\Panda Security\ActiveScan 2.0\pskavs.dll" and "C:\WINDOWS\system32\ActiveScan\pskavs.dll". I ran a complete scan at Panda, but it would take nearly a whole day and it was only at 40% with 33 instances found so I just gave up and canceled. Does it normally this this long to run a scan? Is this a real virus or false positive. Last edited by maxima2k2 : 07-01-2008 at 07:27 AM.

07-01-2008, 08:17 AM	#2 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 25,361 OS: 2000 Pro; XP Pro; XP Home	Re: Avira found 2 viruses named 'W95/Blumblebee.1738' It is a false positive from Avira because Panda Antivirus does not encrypt its virus database. So, some scanners see the file definitions the same as infections. Avast has the same issue, and explains it here: http://www.avast.com/eng/virus_detec....html#idt_1554 As far as taking a long time, it depends on how large the hdd is, and how many files need be scanned. Also, the resident AV should be disabled when performing an online scan. The resident gets jealous when the online scanner looks at files, and it wants a peek, too. This slows things down greatly. __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Our help is voluntary, but this site needs donations to operate. Please consider Donating to the Forum. Please do not ask for help via Private Message. Ask in the forums, so all may gain from the experience.

07-01-2008, 09:05 AM	#3 (permalink)
maxima2k2 Registered User Join Date: Feb 2007 Posts: 59 OS: win xp	Re: Avira found 2 viruses named 'W95/Blumblebee.1738' update: Just did another Avira scan with a couple more updates and it found 3 more infected files "C:\System Volume Information\_restore{58E30938-66A1-4D08-9DCD-360CE25B3A88}\RP378\A0078420.dll", "C:\System Volume Information\_restore{58E30938-66A1-4D08-9DCD-360CE25B3A88}\RP381\A0078490.dll" and "C:\System Volume Information\_restore{58E30938-66A1-4D08-9DCD-360CE25B3A88}\RP381\A0078491.dll". All of these files were quararentined. Thanks