default.xml from Dell SupportCenter is virus/trojan?

Question

Hello, I recently bought a new Insp1521 and have scanned it regularly with several different malware detectors without incident. A couple days ago, I got a message to install/setup the Dell SupportCenter which I did. Yesterday I started getting messages from Avira AntiVir saying that the default.xml file was a script virus: Begin scan in 'C:\ProgramData' C:\ProgramData\SupportSoft\DellSupportCenter\SYSTEM\data\default.xml [DETECTION] Contains detection pattern of the HTML script virus HTML/Zones.Gen Avira support said they were unable to analyze the file separately but they were sure it was malware of some sort. Any else have this issue and/or knows what's going on? Thanks.

Dave Lyle · Answer

Most likely a false positive. To be sure, check the file at VirusTotal and/or Jotti.

Bugbatter · Answer

s-insp-8200, please let us know the results in case someone else has the same problem. Thanks.

thedelboy · Answer

Yes,I have two dimensions reporting the same error in different locations.So it looks like its Antivir has a problem.I will load it on an XP inspiron and see if the warning appears on it.

joe53 · Answer

Others are reporting this Dell Supportcenter file detection to Avira, which strongly suggests a false positive: http://forum.avira.com/thread.php?postid=255185    Note the link in the above thread to send the file to Avira for checking.

Bugbatter · Answer

Thank you, Joe! :)

s-insp-8200 · Answer

Hello, thanks for the responses. I haven't had the chance to check VirusTotal or Jotti's yet but before posting the first message, I did several searches. I came across the message on Avira's forum and sent them the file but the response was: 'MALWARE (NOT ANALYZABLE) In particular this means that this file is not working properly or not functional as a stand alone component. Nevertheless we were able to determine that it is malware.' So are they saying it's NOT a false positive?

Bugbatter · Answer

'So are they saying it's NOT a false positive?' I think that's probably their generic reply for something they don't recognize.

s-insp-8200 · Answer

Ok, but it would make more sense to clarify it as such in the form letter (ie. *possibly* malware). Anyway, I scanned my file with VirusTotal and Jotti - it seems only Avira reports something (HTML/Zones.Gen). So either they are much better than the others at identifying this or they are wrong (most likely). Thanks again! Oh... at the very last second... Webwasher-Gateway : Script.Zones.Gen

Virus & Spyware

default.xml from Dell SupportCenter is virus/trojan?

Was this post helpful?