Deepscan:generic.hupigon.346f4697 = Wiseftp -- A False Positive?

M.C.
M.C.
edited June 2007 in Malware talk

Hello,


three days ago (only) the bd-engine of my av-program started to identify two files of the program WiseFTP 4 as viruses.


wf_tp.exe = DeepScan:Generic.Hupigon.994745CE


wise_ftp.exe = DeepScan:Generic.Hupigon.346f4697


After moving the files in quarantine two new files in the directory "System Volume Information\_restore...\RP93\" seem to be infected with the same viruses.


A0009786.exe = DeepScan:Generic.Hupigon.994745CE


A0008808.exe = DeepScan:Generic.Hupigon.346f4697


Is this possibly a false positive?


Thanks for your help


Mike


PS: Unfortunately it was not possible to upload one of the files.


I received this message: Upload failed. Please ask the administrator to ensure the uploads directory is writeable

Comments

  • AndreiASM
    AndreiASM

    Today the upload problem should dissapear.


    As for the viruses which appear in System Volume Information, please diables System Restore temporarly and temporarly deactivate BD realtime protection.


    Andrei

  • r.karl@kraichgau-hoffe.de
    r.karl@kraichgau-hoffe.de
    Today the upload problem should dissapear.


    As for the viruses which appear in System Volume Information, please diables System Restore temporarly and temporarly deactivate BD realtime protection.


    Andrei


    Hello,


    I cannot believe that the deactivation of BD realtime protection is a solution ... The Hupigon issue occurs in several threads and is still unresolved by the BD team. There is obviousely a FP alert by BD after the recent XP security updates and BD updates. Please check the files indicated in the threads with the latest XP SP02 security updates and BD updates.


    Thanks !


    Ruediger

  • AndreiASM
    AndreiASM
    Hello,


    I cannot believe that the deactivation of BD realtime protection is a solution ... The Hupigon issue occurs in several threads and is still unresolved by the BD team. There is obviousely a FP alert by BD after the recent XP security updates and BD updates. Please check the files indicated in the threads with the latest XP SP02 security updates and BD updates.


    Thanks !


    Ruediger


    You didn't fully understand my advice: if you want to clean the System Volume Information, which stores restore points for your computer, you have to do the following:


    1. Deactivate BD real-time protection


    2. Right-click on My-computer, go to System Restore, and chek the "Turn off System restore on all drives", then ok


    3. Re-enabled System-restore by un-checking that check box


    4. Rer-enable BD real-time protection


    You have to deactivate BD real-time protection because when cleaning the SVI folder, BD will still scan the files while deleted, and will block the (possible) infected files.


    Andrei

  • khufu
    khufu

    If you consider that those files are clean, you should upload them here: http://www.virustotal.com/en/indexf.html and they will be scanned by a number of AV engines.

  • M.C.
    M.C.
    If you consider that those files are clean, you should upload them here: http://www.virustotal.com/en/indexf.html and they will be scanned by a number of AV engines.


    Hi, khufu


    I have already uploaded them to virustotal and there was only one engine that identified my files as DeepScan:Generic.Hupigon.994745CE.


    This scanner was BitDefender 7.2 (what a surprise :-)).


    I also checked the files at virusscan.jotti.org with the same result. Only BitDefender reacted.


    Jotti also showed me this message: "Note: this file was only classified as malware by scanners known to generate more false positives than the average scanner. Do not consider these results definately accurate."

  • khufu
    khufu

    Then upload the files here(i hope you can) and wait for VR`s to download them and remove the detection if they are clean.

  • AndreiASM
    AndreiASM

    Please wait until upload will be posible on this forum. You don't have to be 100% certain that the file is infected or not. It could be a FP, and VR will remove the detection if necesarly.


    Andrei

  • M.C.
    M.C.

    Have you any idea when the upload will be possible again?

  • AndreiASM
    AndreiASM

    The upload should be avaible starting from today... I hope it will be avaible starting from today. :)


    Andrei

  • M.C.
    M.C.

    It is still impossible to upload files.


    Is there an other place where I can send them to?

  • Niels
    Niels ✭

    Hello MikeC


    You can still send them to : virus_submission@bitdefender.com


    Or you can upload them to an online file host e.g: http://www.verzend.be , http://www.rapidshare.com and post the downloadlink, etc or wait till the problem is fixed.


    Regards


    Niels

  • Crem
    Crem

    Hi Niels ! I have uploaded file infected malware and i have waited for long time but my problem have no fix to now :(

  • vlad
    vlad

    To make things easier, from now on I'll have a look myself at mails sent to virus_submission@bitdefender.com which have 4VIR in the subject line. MikeC, please pack the files in an archive with the password infected and send them to that address with 4vir somewhere in the subject.

  • M.C.
    M.C.

    Hello vlad,


    thank you for your help.


    I have send the files to you.


    Regards


    Mike

  • vlad
    vlad

    I managed to find the mail eventually; the detection has been removed. All the Generic.Hupigon.* chaos will be fixed permanently by tomorrow the latest.

  • r.karl@kraichgau-hoffe.de
    r.karl@kraichgau-hoffe.de

    Hello Vlad,


    I also send an email to virus_submission@bitdefender.com with the subject 4VIR. I attached a packed file, which issues the generic.Hupigon virus alert by BD. Please verify with your fix.


    Regards,


    rka

  • vlad
    vlad

    It's fixed, and all the other Generic.Hupigon.* false positives should disappear. Please update your BD virus definitions.

  • Unknown
    Unknown

    Starting from today you can once again upload your files on the forums. There is a 2MB limit.

All Time Leaders

Categories

Defenders of the month