Possibly a false positive?

Archive
1

So my PC has been off for a week and I started it up last night and the first thing I did was update Norton, though I didn't run a full scan until today.  I scan my PC pretty obsessively (pretty much whenever I'm taking a break I'll just run a full scan) and certainly did before I powered off my PC about a week ago.  Well after running a full scan today I got two hits (I haven't downloaded a thing for quite awhile and am a paranoid browser using uBlock Origin) in a very odd folder.  Everything in it was created on the same day last year and they appear to be a complete mishmash of stuff that looks like spam email graphics, though I noticed several were transactions for a game I bought many years ago as well as a crappy drawing that I couldn't have created any later than 2012 and emailed to someone.  I have no clue about most of the stuff there and I simply don't even click on any spam mail.  So I'm really confused about the contents of this folder and directory, as well as the two seemingly infected files in question.  I clicked to submit samples to Norton but was annoyed to find that it doesn't allow me to send them immediately, only during inactive hours.  Anyway I can get around that and send them now?  And should I create new passwords for everything now after running several scans and Norton Power Eraser and coming up clean?  File info below and thanks for any help.

 

 

 

Filename: PURCHASE-ORDER[48].htm
Threat name: Phish.HtmlFull Path: C:\Users\*****\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\Files\S0\4\Attachments\PURCHASE-ORDER[48].htm

____________________________

____________________________


On computers as of
6/26/2023 at 6:15:04 PM

Last Used
6/26/2023 at 6:17:10 PM

Startup Item
No
Launched
No
Threat type: Virus. Programs that infect other programs, files, or areas of a computer by inserting themselves or attaching themselves to that medium.


____________________________


PURCHASE-ORDER[48].htmThreat name: Phish.Html
Locate


Very Few Users
Fewer than 5 users in the Norton Community have used this file.

Very New
This file was released less than 1 week  ago.

High
This file risk is high.


____________________________


Source: External Media

Source File:
PURCHASE-ORDER[48].htm

____________________________

File Actions

Infected file: C:\Users\****\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\Files\S0\4\Attachments\PURCHASE-ORDER[48].htmRemoved

Infected file: C:\Users\****\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\Files\S0\4\Attachments\PURCHASE-ORDER[47].htmRemoved

____________________________

 

2

This is a sample of what you might have seen after submission.

 

3

You have got your submission done there only Submission ID generated to check on further progress. Although analyse takes at least 48 Hours. So try downloading your file again, if you know it to be legitimate, after a week.

4

Thank you very much!  Is there any way to be notified if what was submitted is a false positive or not?

5

I hope this link gonna help you.

https://knowledge.broadcom.com/external/article/178064/how-to-submit-suspicious-files-via-the-o.html

In this link wherever you find written Symantec just replace it with Norton to locate installed Norton folder.

6

Thank you for the link!  How do I find a file that's been quarantined to upload?

7

Use this link to share either False Positive or False Negative.

https://submit.norton.com/?type=FN