Trojan SHeur, TrendMicro, AVG

I am running Windows XP Home and, like the original poster, I have a 120GB Western Digital Passport drive that I plug into the USB for file ttransfers, backups, etc. I had placed a copy of the WDSync program on my desktop computer as a backup.

Today, AVG told me that I have a Trojan called SHeur.NFD in my WDSync folder, so I placed the three .exe files into the virus vault. This has never appeared as a problem before. When I did a Google search on this Trojan, the only search result was the post (above) which was published just today. Is this suddenly a new threat, or just an over-zealous anti-virus program?

Thanks to all who can identify what has happened today.

Pat

If so, turn it off and re-scan - see if you still get a positive.

I'm curious as to the spelling of this 'virus'.

AVG had a problem recently with a similar situation.

I have run into situations where AVG signaled false positives for several executables. At the time, I made note of the files that threw the alert and moved them to the AVG Virus Vault. Two days and two AVG updates later, I restored the files from backup and AVG no longer saw them as a threat.

I have experienced this situation a few other times over the years, but it seems to have become more frequent in just the past two months. Since I typically have over 300GBs of software installed, chances are, if anyone is going to run into a false positive issue, it'll be me.
Since I use the Free version of AVG, there is no way for me to alert them of the false positive (no tech support for the free version). I end up just waiting until a future signature file update corrects the error. So far, this has never taken any longer than four days. ...so far.

I suspect AVG has changed the way they test and release signature file updates. In every circumstance, it involved a so-called Trojan. Hopefully, it's only a temporary thing and not a trend.

[b]Your[/b] situation may or may not be related but, I'm with you, I would be 'suspicious.'

I have faced an FP situation with AVG for the first time in five years ... started using it in 2002. So, tried to figure out the truth. Here's an update.

I managed to get the file tested at virustotal (after stopping resident shield) ... the relevant parts are :-

File WDSync.exe received on 09.16.2007 23:22:40 (CET)
Current status: finished
Result: 2/32 (6.25%)

Antivirus Version Last Update Result
AVG 7.5.0.485 2007.09.16 -
Sunbelt 2.2.907.0 2007.09.15 VIPRE.Suspicious
Webwasher-Gateway 6.0.1 2007.09.16 Virus.Win32.FileInfector.gen (suspicious)

Additional information
File size: 4347904 bytes
MD5: d8a1b837f40c4f3e94518ee10509df66
SHA1: abef9d752fffeb2df0c7ebde5a6ac7383af51c32
packers: embedded
packers: embedded
Sunbelt info: VIPRE.Suspicious is a generic detection for potential threats that are deemed suspicious through heuristics

I notice from the above results that their test included AVG 7.5.0.485, which gave negative. However, my AVG is a later 7.5.487.
I also tried testing at jotti, but the result was getting stuck at Panda. A-squared to Norman (including AVG) found nothing.

Meanwhile, AVG technical support has said : "Unfortunately, the previous virus database
might have detected the mentioned virus on some legitimate applications. We can confirm
that it was a false alarm. We have mmediately released a new virus update that removes the
false positive detection on this file. Please update your AVG and check your files again. This file is not detected by AVG with AVG Virus Database version 269.13.21/1012".

I shall do a complete sys-scan with the latest defs ... hopefully, all will come ok.

Any idea why sunbelt and webwasher also suspected virus - I am curious.