Win32/Riskware.PEMalform.I

[dgeorge 0]

"A threat  (WWin32/Riskware.Malform.I  was found in a file that Norton security tried to access.

The file has been deleted."

I get this message 6 or 7 times a day from ESET smart security even after I have run all the scans.  Do I need to do something?  Thanks

[itman 1,659]

Do you have Norton Antivirus or Internet Security installed?

[Marcos 5,074]

Not sure what program renders files malformed. I'd remove any other security software and run a full disk to remove the malformed files.

[dgeorge 0]

Yes, Norton Antivirus is installed

[notimportant 5]

16 hours ago, dgeorge said:

Yes, Norton Antivirus is installed

So you are running two AV programs at the same time? Thats not a good idea, you should use just one, ESET or Norton.

[itman 1,659]

16 hours ago, dgeorge said:

Yes, Norton Antivirus is installed

This appears to be a classic example of why security experts universally agree that one AV solution's realtime scanning be enabled at any given time.

I suspect what we have here is an AV "deadly embrace" situation. Norton first attempts to scan the file. Eset detects that Norton is the threat actor for doing so and blocks any further activity by Norton. Eset states that it deleted the file containing the malware but it hasn't because Norton has a lock on the file. We are now in a perpetual loop situation were the dual AV detection activity is repeated over and over again. 

Solution - if you insist on use Noton, then disable its realtime scanning option and only use it as a second opinion AV scanner.

[Nightowl 202]

On 11/1/2018 at 11:01 PM, dgeorge said:

Yes, Norton Antivirus is installed

Just as the others said , stick with one AV running as real time, If you would like the other AV and you don't want to remove it , you can keep it as secondary AV but make sure it's not running real-time scanning , otherwise they will just keep making conflicts.

Edited November 4, 2018 by Rami