6 replies to this topic

[WilsonB]

WARNING!!

 

Malware loaded in latest 10.6 10/6/2019 upload!!!

Packed.Win32.MUPX.Gen@1

VPinballX.exe

 

Verified with COMODO

 

 

Track down and BAN !

 

 

 

[Thalamus]

My answer to that is - then COMODO sucks.

Have you tried to upload it to https://www.virustot...gui/home/upload and see what other virus scanners say about the file ?

[toxie]

Yup, bogus false positive!

[DCLXVI]

Well that new release is very strange.

 

The installer itself VPX6setup.exe is detected as containing trojan/malware by 7 engines

 

https://www.virustot...873fc/detection

 

I don't see why it should access registries like :

• HKLM\System\CurrentControlSet\Services\LDAP
• HKLM\System\CurrentControlSet\Services\LDAP\UseOldHostResolutionOrder
• HKLM\System\CurrentControlSet\Services\LDAP\UseHostnameAsAlias

 

The pinMane32.exe is detected by 3 engines

 

https://www.virustot...248f1/detection

 

Not sure why it's opening C:\Users\<USER>\Downloads ??? , It's also playing with LDAP, and it seems to be creating a lot of files, going all the places checking permissions of dlls.

 

And VPinballX.exe is detected by Comodo. Again not sure why it's accessing those registries.

 

https://www.virustot...eaeccab/details

• \Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\996E.exe
• \Registry\MACHINE\System\CurrentControlSet\Control\SafeBoot\Option
• \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
• \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\TransparentEnabled
• \REGISTRY\USER\S-1-5-21-1482476501-1645522239-1417001333-500\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

 

That does not look like a false positive.

Edited by DCLXVI, 23 November 2019 - 02:18 PM.

[zeek11]

Hey team...had the same kick back when scanning the 10.7 file with Comodo. However, when scanned with Defender...no hits. ?

[Thalamus]

Take 60 virus scanners - take almost any binary that can access hardware like vp does, there will be false positives. If you are in doubt. Source code is on github, vscode is free  - have at it.

[zeek11]

Understood and that's what I suspected. Thank you for the response. I will look forward to upgrading to 10.7