Possible virus in .scr file. Is this a false positive?

JK111 · 2023-09-20T13:05:27+00:00

There was an error rendering this rich post.

A year ago I downloaded some retro screensavers from Windows 95, including one called "ssstars.scr". It's been on my Windows 10 computer for about a year and hasn't caused any problems for me at all. Yesterday, I did a Bitdefender scan and got the following message: "The file C:\Windows\System32\ssstars.scr is infected with Gen:Heur.Jatommy.02117.am0@bqkaRbh and was moved to quarantine." Strangely, Bitdefender has never recognized any malware on this file before. I did a Malwarebytes scan and it didn't detect any malware on my computer at all.

I restored the file and uploaded it on VirusTotal and it wasn't flagged by any vendors. I did another Bitdefender scan and now it's not being recognized as malware and it's still on my computer. Is this a sign it was a false positive? I don't know why it was recognized as malware, and after restoring the file to my computer it's not longer being recognized as one.

Also, what category of malware is "gen:heur"?

Would appreciate any insight.

Find more posts tagged with

Accepted answers

All comments

Gjoksi

Hello.

Only the anti-malware researchers at Bitdefender Labs can help you with the issue.

You should report the file(s) and/or the URL(s) as false positive to Bitdefender Labs here:

https://www.bitdefender.com/consumer/support/answer/29358/

You could also share the VirusTotal link of the file(s) and/or the URL(s) that was(were) detected to the malware researchers.

Regards.

Flexx

"Gen:heur" is a generic detection used by antivirus software to indicate that a file is suspected of being malware. This detection is typically based on heuristic analysis, which is a technique that analyzes the behavior of a file to determine if it is malicious.

Heuristic analysis is a powerful tool for detecting new and emerging malware strains. However, it can also lead to false positives.

If you are unsure about whether a file detected as "gen:heur" is actually malware, you can share the file with malware researchers as stated by @Gjoksi above.

Regards