# setup.elf: false positiv or true positive?

## onelove

hi!

today, i emerged f-prot for the first time. subsequently, i did a 

```
/opt/f-prot/fpupdate
```

 followed by a

```
fpscan -a -o scanreport.txt
```

here is the result:

```
F-PROT Antivirus version 6.2.1.4252 (built: 2008-04-28T16-56-20)

FRISK Software International (C) Copyright 1989-2007

Engine version: 4.4.4.56

Virus signatures: 200910221103326b092ae753a5ce2fd1b96958886ff4

                  (/opt/f-prot/antivir.def)

[Not scanning] <Not a regular file or directory>        /var/run/xdmctl/dmctl/socket

[Not scanning] <Not a regular file or directory>        /var/run/xdmctl/dmctl-:0/socket

[Not scanning] <Not a regular file or directory>        /var/run/mdnsd

[Not scanning] <Not a regular file or directory>        /var/run/cups/cups.sock

[Not scanning] <Not a regular file or directory>        /var/run/dbus/system_bus_socket

[Not scanning] <Not a regular file or directory>        /tmp/.X11-unix/X0

[Not scanning] <Not a regular file or directory>        /tmp/.ICE-unix/4764

[Not scanning] <Not a regular file or directory>        /tmp/ksocket-dsmdn52/kdeinit4__0

[Not scanning] <Not a regular file or directory>        /tmp/ksocket-dsmdn52/klauncherMT4755.slave-socket

[Unscannable] <File is damaged> /home/dsmdn52/computer/winxppro32/dotnet35sp1/dotnetfx35.exe->(CAB)->wcu\.\.\.\.\.\dotNetFramework\dotNetFX20\prexp.msp

[Unscannable] <File is damaged> /home/dsmdn52/computer/winxppro32/dotnet35sp1/dotnetfx35.exe->(CAB)->wcu\.\.\.\.\.\dotNetFramework\dotNetFX20\winforms.msp

[Unscannable] <File is damaged> /home/dsmdn52/computer/winxppro32/dotnet35sp1/dotnetfx35.exe->(CAB)->wcu\.\.\.\.\.\dotNetFramework\dotNetFx35setup.exe->(CAB)

[Unscannable] <File is damaged> /home/dsmdn52/computer/winxppro32/dotnet35sp1/dotnetfx35.exe->(CAB)->wcu\.\.\.\.\.\dotNetFramework\dotNetFX35\x86\netfx35_x86.exe->(CAB)->vs_setup.cab

[Unscannable] <File is damaged> /home/dsmdn52/computer/winxppro32/dotnet35sp1/dotnetfx35.exe->(CAB)->wcu\.\.\.\.\.\dotNetFramework\dotNetFX35\x64\netfx35_x64.exe->(CAB)->vs_setup.cab

[Unscannable] <File is damaged> /home/dsmdn52/computer/winxppro32/dotnet35sp1/dotnetfx35.exe->(CAB)->wcu\.\.\.\.\.\dotNetFramework\dotNetFX35\ia64\netfx35_ia64.exe->(CAB)->vs_setup.cab

[Error] <Scanning error>        /home/dsmdn52/.ooo3/user/config/standard.sob

[Error] <I/O error>     /home/dsmdn52/.ooo3/user/config/standard.sob

[Found possible virus] <Heuristic-90 (not disinfectable)>       /usr/src/linux-2.6.30-gentoo-r7/arch/x86/boot/setup.elf

[Found possible virus] <Heuristic-90 (not disinfectable)>       /usr/src/linux-2.6.30-gentoo-r8/arch/x86/boot/setup.elf

[Error] <Scanning error>        /usr/portage/distfiles/php-5.2.10.tar.bz2->(packed)->php-5.2.10/ext/bz2/tests/004_2.txt.bz2

[Error] <Scanning error>        /usr/portage/distfiles/php-5.2.10.tar.bz2->(packed)

[Error] <Scanning error>        /usr/portage/distfiles/php-5.2.10.tar.bz2

[Error] <Internal engine error> /usr/portage/distfiles/php-5.2.10.tar.bz2

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u16-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_16/lib/ct.sym

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u16-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_16/lib/ct.sym

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u16-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_16/lib/ct.sym

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u16-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_16/lib/ct.sym

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u16-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_16/lib/ct.sym

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u16-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_16/lib/ct.sym

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u16-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_16/lib/ct.sym

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u16-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_16/lib/ct.sym

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u16-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_16/lib/ct.sym

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u16-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_16/lib/ct.sym

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u16-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_16/lib/ct.sym

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u16-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_16/lib/ct.sym

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u16-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_16/lib/ct.sym

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u16-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_16/lib/ct.sym

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u16-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_16/lib/ct.sym

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u16-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_16/lib/ct.sym

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u16-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_16/lib/ct.sym

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u16-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_16/lib/ct.sym

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u16-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_16/lib/ct.sym

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u16-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_16/lib/ct.sym

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u16-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_16/lib/ct.sym

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u16-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_16/lib/ct.sym

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u16-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_16/lib/ct.sym

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u16-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_16/lib/ct.sym

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u16-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_16/lib/ct.sym

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u16-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_16/lib/ct.sym

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u16-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_16/lib/ct.sym

[Error] <Scanning error>        /usr/portage/distfiles/php-5.2.11.tar.bz2->(packed)->php-5.2.11/ext/bz2/tests/004_2.txt.bz2

[Error] <Scanning error>        /usr/portage/distfiles/php-5.2.11.tar.bz2->(packed)

[Error] <Scanning error>        /usr/portage/distfiles/php-5.2.11.tar.bz2

[Error] <Internal engine error> /usr/portage/distfiles/php-5.2.11.tar.bz2

[Unscannable] <File is damaged> /usr/portage/distfiles/nmap-4.76.tar.bz2->(packed)->nmap-4.76/mswin32/vcredist_x86.exe->(CAB)->vc_red.cab

[Unscannable] <File is damaged> /usr/portage/distfiles/openjade-1.3.2.tar.gz->(packed)->openjade-1.3.2/SP.mak

[Unscannable] <File is damaged> /usr/portage/distfiles/openjade-1.3.2.tar.gz->(packed)

[Unscannable] <File is damaged> /usr/portage/distfiles/git-1.6.4.4.tar.bz2->(packed)->git-1.6.4.4/t/t3900/1-UTF-8.txt

[Unscannable] <File is damaged> /usr/portage/distfiles/glibc-2.9-20081201.tar.bz2->(packed)->glibc-2.9-20081201/iconvdata/testdata/IBM1164..UTF8

[Unscannable] <File is damaged> /usr/portage/distfiles/glibc-2.9-20081201.tar.bz2->(packed)->glibc-2.9-20081201/iconvdata/testdata/IBM1132..UTF8

[Unscannable] <File is damaged> /usr/portage/distfiles/glibc-2.9-20081201.tar.bz2->(packed)->glibc-2.9-20081201/iconvdata/testdata/IBM1160..UTF8

[Unscannable] <File is damaged> /usr/portage/distfiles/glibc-2.9-20081201.tar.bz2->(packed)->glibc-2.9-20081201/iconvdata/testdata/IBM4517..UTF8

[Unscannable] <File is damaged> /usr/portage/distfiles/glibc-2.9-20081201.tar.bz2->(packed)->glibc-2.9-20081201/iconvdata/testdata/IBM1025..UTF8

[Unscannable] <File is damaged> /usr/portage/distfiles/vim-7.2-extra.tar.gz->vim-7.2-extra.tar->vim72/src/os_beos.rsrc

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u15-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_15/lib/ct.sym

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u15-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_15/lib/ct.sym

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u15-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_15/lib/ct.sym

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u15-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_15/lib/ct.sym

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u15-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_15/lib/ct.sym

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u15-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_15/lib/ct.sym

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u15-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_15/lib/ct.sym

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u15-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_15/lib/ct.sym

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u15-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_15/lib/ct.sym

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u15-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_15/lib/ct.sym

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u15-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_15/lib/ct.sym

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u15-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_15/lib/ct.sym

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u15-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_15/lib/ct.sym

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u15-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_15/lib/ct.sym

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u15-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_15/lib/ct.sym

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u15-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_15/lib/ct.sym

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u15-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_15/lib/ct.sym

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u15-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_15/lib/ct.sym

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u15-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_15/lib/ct.sym

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u15-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_15/lib/ct.sym

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u15-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_15/lib/ct.sym

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u15-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_15/lib/ct.sym

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u15-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_15/lib/ct.sym

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u15-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_15/lib/ct.sym

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u15-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_15/lib/ct.sym

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u15-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_15/lib/ct.sym

[Unscannable] <File is damaged> /usr/portage/distfiles/jdk-6u15-dlj-linux-amd64.bin->(ZIP)->jdk1.6.0_15/lib/ct.sym

[Error] <Scanning error>        /usr/lib64/openoffice/basis3.1/presets/config/standard.sob

[Error] <I/O error>     /usr/lib64/openoffice/basis3.1/presets/config/standard.sob

Results:

Files: 558309

Skipped files: 0

MBR/boot sectors checked: 13

Objects scanned: 3854339

Infected objects: 2

Files with errors: 82

Disinfected: 0

Running time: 37:25
```

are the two possible viruses false positives? meaning they are classified as a virus, but that classification is wrong? or are they real viruses? other thing i am wondering about: i use a x86_64 system. but the classification result was found in the x86-directory. i dont know what to do now. any1 had a similar situation?

regards,

onelove

----------

## xaviermiller

Hello,

Upload the file to http://www.virustotal.com/ which will launch about 40 antiviruses.

(EDIT: bad URL)

----------

## onelove

Authentium   5.1.2.4   2009.10.22   Heuristic-90

F-Prot   4.5.1.85   2009.10.22   Heuristic-90

Result: 2/41 (4.88%)

what is the so called "heuristic-90"? is there any database to look after the specific heuristic? i mean, what binary-patttern is responsible for the alert? has anyone else problems with this specific file?

regards,

onelove

----------

