Original HP MediaSmart Server Recovery Disc with Heur.aDVml.c and Trojan.Gen.2 onboard

[Ron_retired]

Well, my original EX495 MediaSmart server is working so well and has been for so long that I've forgotten the log-in password.  No prob, you say, just take that good old v3.0 Server Recovery Disc that's been sitting in the box for about 10 years, fire it up and recover my server keeping Data intact.  Blah Blah Blah

First, forgive my sarcasm.  I'm annoyed because shortly after inserting HP's disk into an internal disk drive, Windows 10 comes to full Red Alert anouncing SEVERE SECURITY WARNING.  I immediately ran a Norton Internet Security scan and lo and behold the disk is infected with Heur.ADvML.C AND Trojan.Gen.2  which Norton identifies as SEVERE infections.  Remember, these are the original disks that came with my server.

To complicate matters, HP does not provide a direct download link to the Server Recovery Disc.  However, in the MediaSmartforum  Archive there is a discussion about consumers purchasing 2nd hand HP MediaSmarts and where to get the original or copies of the Installation, PC Restore and Server Recovery Disc.  Of course, HP does not provide a link whereas one of the very helpful forum members provided a link to a good drive with the software on it (https://drive.google.com/drive/folders/0BzRIeI12rXCDNXNlWFdzY29JYm8) which is also infected with Heur.AdvML.C and Trojan.Gen.2   Of course, this is to be expected because the downloaded files are disk image files.

So, if anyone at HP is listening:  I'd like to recover my EX495.  The supposedly safe discs you provided are infected.  I have no interest in litigating negligence on HP's part.  I just want to recover my server.  A deep dive into your software archive would be really helpful and posting the (cleaned up) software at https://support.hp.com/us-en/product/hp-ex490-mediasmart-server-series/3969714/model/3969716  would go a long way to making this consumer happy.

cheers

[TheOldMan]

In doing some research on the "supposed" infection.  It appears to be a false positive from Norton.  You can read on the problem by doing a short search on Goggle but do not worry.  Disable the Norton Internet Security  or mark that file as an exception or whatever the term on their security exemption setting and go about what you want to do.

[Ron_retired]

TheOldMan

Good morning.  Unfortunately, the false positive position is questionable. 

A dive into the Norton forums about Norton flagging the two files as false positives ultimately runs into Norton taking the position that Heur.aDVml.c and Trojan.Gen.2 are malicious.  Yes, there are many arguing they are a false positive but Norton's position is not so clear.

Granted, the discussions don't specifically discuss the HP MediaSmart Recovery discs ('I'm pointing Norton in that direction) but for now, caution is warranted.    

With the server directly connected to an expendable laptop,  I could always just run the recovery disk and then (hopefully) clean up any infection after the fact.   I'd ensure that both the laptop and the server are isolated from my network.  

In the end, HP engineered a great little box in the  MediaSmart.  A Questionable recovery disc ?????

Cheers  

[Ron_retired · Accepted solution]

Solution to infected Server Recovery Disc ...

Norton's official word:  Heur.aDVml.c is actually hp-tftpd32.exe a system file or driver and a false positive

                                               Trojan.Gen.2   is actually hp-tftpd32.exe a system file or driver and a false positive

                                               "They are false positive because if the detection is Heur.ADvML.C normally they are not threat but a

                                                 files or drivers from your Operating System.

The info is not from a search of the Norton forums but rather direct interaction by me with Norton's Live Spyware and Virus Removal Services today (August 28/18).

CHeers

[TheOldMan]

I'll just wipe this and say great glad it is sorted out.