[solved] Malware Resides In Executables.......

I have a setup of a game named Alien Star. I scanned this setup through Bitdefender Contextual Scan and there is no infection found in it, but when I execute the setup, Bitdefender found an infection named “Backdoor.Bot.56214” in temp files created by the Alien Star setup and I've to abort the setup.

Although all the options in the Contextual Scan are checked, it seems that Bitdefender fails to detect malwares resides in the executables and didn’t thoroughly scan the executables.

Find more posts tagged with

Comments

csalgau

There is a high probability that the installer is using an unrecognized format for storage, or a standard one that has been modified to make it non-standard, and BitDefender cannot access the content at this time, although the real-time scanner does read them after they are accessed by the installer itself.

We'll look into the detection provided, in case this is a false positive. Thank you for the report.

coolcool1227

How would I know about the status of detection? Should I disable Bitdefender in order to install this game(if the setup is supposed to be clean although infected with a false positive detection)?

I got scan results of Alienstar setup from "www.virustotal.com" and found that only below antivirus softwares find it infected.

1) Antiy-AVL 2.0.3.7 2010.04.21 Backdoor/Win32.Rbot.gen

2) ClamAV 0.96.0.3-git 2010.04.21 PUA.Packed.ASPack

3)TheHacker 6.5.2.0.265 2010.04.21 Trojan/Constructor.Kalips.c

csalgau

Detection has been scheduled for removal. Thank you for the report. Have a nice day!

coolcool1227

Hello Catalin

Should you need that game installer about which you said "that the installer is using an unrecognized format for storage, or a standard one that has been modified to make it non-standard" for further analysis ?

csalgau

I found it myself, but apparently I misplaced it.

If you wouldn't mind, please upload the file somewhere and PM me a link.

Thank you.

coolcool1227

Hello Catalin

Did you receive PM?

coolcool1227

Hello Catalin

Did you receive PM regarding alienstar setup or should I resend PM?

And if you receive PM, although the False Positive is fixed, what is the status of that executable and why Bitdefender didn't properly detect in Real_Time?

alexcrist

The detection has been removed, as Catalin posted above.

Also, as Catalin stated in second post, not all installers can be fully unpacked by BitDefender. It depends very much on the type of compression used and, most of all, if it's any kind of modified compression (if it's modified, there are chances that BitDefender can't unpack it). That is why it's important that you keep Realtime Protection enabled: to prevent cases in which On Demand scan fails to fully scan a compressed files, but which self-decompresses when run (in which case, BitDefender can detect it).

Since the issue presented in this topic was solved, I will consider this topic closed. Have a nice day.

Cris.

== CLOSED ==

== Issue solved ==