Kaspersky and PornDialer

  • Thread starter Thread starter Buffalo
  • Start date Start date
B

Buffalo

Kaspersky found 8 instances of what it classified as
"PornDialer.Win32.CDUpdater.g" on my PC.
I believe they are false positives. This just happened after I updated the defs
today.
One of the hits was in a folder that is a copy of the Win98SE cd.
It is a folder called Win98SE on my PC and the hit was on Win98_OL.CAB.
When I extracted that cab into a temp folder, Kaspersky identified the problem
file as MSNForIE.dll.
I sent that file to virustotal and it showed no hits.
Is anyone else having this problem with Kaspersky recently?
Thanks
 
Kaspersky found 8 instances of what it classified as
"PornDialer.Win32.CDUpdater.g" on my PC.
I believe they are false positives. This just happened after I updated the defs
today.
One of the hits was in a folder that is a copy of the Win98SE cd.
It is a folder called Win98SE on my PC and the hit was on Win98_OL.CAB.
When I extracted that cab into a temp folder, Kaspersky identified the problem
file as MSNForIE.dll.
I sent that file to virustotal and it showed no hits.
Is anyone else having this problem with Kaspersky recently?

Send the the DLL file to Kaspersky so they can correct the FP:
(e-mail address removed)

Art

http://home.epix.net/~artnpeg
Free antivirus:
http://www.ik-cs.com/programs/virtools/KASFX.EXE
http://www.claymania.com/KASFX.EXE
http://tinyurl.com/azzkc
 
From: "Buffalo" <eric(nospam)@nada.com.invalid>

| Kaspersky found 8 instances of what it classified as
| "PornDialer.Win32.CDUpdater.g" on my PC.
| I believe they are false positives. This just happened after I updated the defs
| today.
| One of the hits was in a folder that is a copy of the Win98SE cd.
| It is a folder called Win98SE on my PC and the hit was on Win98_OL.CAB.
| When I extracted that cab into a temp folder, Kaspersky identified the problem
| file as MSNForIE.dll.
| I sent that file to virustotal and it showed no hits.
| Is anyone else having this problem with Kaspersky recently?
| Thanks
|

Besides what Art indicated, you can prove if this is a False Positive declaration.

Please submit a sample (or samples) to Virus Total --
http://www.virustotal.com/flash/index_en.html
The submission(s) will then be tested against many different AV vendor's scanners.
That will give you an idea what it is and who recognizes it. In addition, unless told
otherwise, Virus Total will provide the sample to all participating vendors.

When you get the report, please post back the exact results.
 
From: "Buffalo" <eric(nospam)@nada.com.invalid>

| Kaspersky found 8 instances of what it classified as
| "PornDialer.Win32.CDUpdater.g" on my PC.
| I believe they are false positives. This just happened after I updated the defs
| today.
| One of the hits was in a folder that is a copy of the Win98SE cd.
| It is a folder called Win98SE on my PC and the hit was on Win98_OL.CAB.
| When I extracted that cab into a temp folder, Kaspersky identified the problem
| file as MSNForIE.dll.
| I sent that file to virustotal and it showed no hits.
| Is anyone else having this problem with Kaspersky recently?
| Thanks
|

Besides what Art indicated, you can prove if this is a False Positive declaration.

Please submit a sample (or samples) to Virus Total --
http://www.virustotal.com/flash/index_en.html

BTW, I didn't suggest the VT check since I wasn't sure it would prove
anything. Sometimes KAV will have legit detections other av don't have
or don't yet have. When you claim "you can prove" you must know for
sure that the subject malware _variant_ is detected by other
products. The VT check for possible FPs is, in general, inconclusive.
We might make educated guesses sometimes and feel certain about
a conclusion in some particular situations. But not in all situations.

Art

http://home.epix.net/~artnpeg
Free antivirus:
http://www.ik-cs.com/programs/virtools/KASFX.EXE
http://www.claymania.com/KASFX.EXE
http://tinyurl.com/azzkc
 
From: "Art" <[email protected]>

|
| BTW, I didn't suggest the VT check since I wasn't sure it would prove
| anything. Sometimes KAV will have legit detections other av don't have
| or don't yet have. When you claim "you can prove" you must know for
| sure that the subject malware _variant_ is detected by other
| products. The VT check for possible FPs is, in general, inconclusive.
| We might make educated guesses sometimes and feel certain about
| a conclusion in some particular situations. But not in all situations.
|
| Art
|
| http://home.epix.net/~artnpeg
| Free antivirus:
| http://www.ik-cs.com/programs/virtools/KASFX.EXE
| http://www.claymania.com/KASFX.EXE
| http://tinyurl.com/azzkc

Feedback noted. Next time I'll use a qualifier. :-)
 
David H. Lipman said:
From: "Buffalo" <eric(nospam)@nada.com.invalid>

| Kaspersky found 8 instances of what it classified as
| "PornDialer.Win32.CDUpdater.g" on my PC.
| I believe they are false positives. This just happened after I updated the defs
| today.
| One of the hits was in a folder that is a copy of the Win98SE cd.
| It is a folder called Win98SE on my PC and the hit was on Win98_OL.CAB.
| When I extracted that cab into a temp folder, Kaspersky identified the problem
| file as MSNForIE.dll.
| I sent that file to virustotal and it showed no hits.
| Is anyone else having this problem with Kaspersky recently?
| Thanks
|

Besides what Art indicated, you can prove if this is a False Positive declaration.

Please submit a sample (or samples) to Virus Total --
http://www.virustotal.com/flash/index_en.html
The submission(s) will then be tested against many different AV vendor's scanners.
That will give you an idea what it is and who recognizes it. In addition, unless told
otherwise, Virus Total will provide the sample to all participating vendors.

When you get the report, please post back the exact results.

Win98SE is the OS.
Dave, as stated in my original post, I did submit it to virustotal and it showed
no hits.(didn't capitalize the V or T, harder to see).
Last week when I did the scan, none of those files were found.
Same programs. Same files. It must have been caused by the newer definitions.
I am using the on-demand Kaspersky program that Art gave instructions for
several weeks ago.
 
From: "Buffalo" <eric(nospam)@nada.com.invalid>


|
| Win98SE is the OS.
| Dave, as stated in my original post, I did submit it to virustotal and it showed
| no hits.(didn't capitalize the V or T, harder to see).
| Last week when I did the scan, none of those files were found.
| Same programs. Same files. It must have been caused by the newer definitions.
| I am using the on-demand Kaspersky program that Art gave instructions for
| several weeks ago.
|

My apologies... I missed that and I totally blew chunks on this one :-(

I tested the CAB file and and nothing is flagged by the Kasperski engine so it looks like
the False Positive has been corrected.
 
Art said:
Send the the DLL file to Kaspersky so they can correct the FP:
(e-mail address removed)

Art

Yep, I did send those files to VirusTotal but haven't notified Kaspersky yet.
I was using the on-demand scanner that you gave directions for several weeks
ago, thanks for doing that.
(Mwave and wget)
Neither AdAware or ZAPro finds any problems.
Should I send the whole .dlls or just their names?
 
From: "Buffalo" <eric(nospam)@nada.com.invalid>


|
| Win98SE is the OS.
| Dave, as stated in my original post, I did submit it to virustotal and it showed
| no hits.(didn't capitalize the V or T, harder to see).
| Last week when I did the scan, none of those files were found.
| Same programs. Same files. It must have been caused by the newer definitions.
| I am using the on-demand Kaspersky program that Art gave instructions for
| several weeks ago.
|

My apologies... I missed that and I totally blew chunks on this one :-(

I tested the CAB file and and nothing is flagged by the Kasperski engine so it looks like
the False Positive has been corrected.

The false positive was probably caused by additional 'heuristic'
signatures designed to identify code attempting to exploit the
recently discovered vulnerability within KAV engine and CAB scanning
(HEAP OVERFLOW).

A patch for this vulnerability is scheduled for release tomorrow. I
imagine the signatures will be removed shortly after this to minimise
the false positives.

See http://www.kaspersky.com/news?id=171512144 for more information. I
hope I have cleared this up :)
 
David H. Lipman said:
From: "Buffalo" <eric(nospam)@nada.com.invalid>


I tested the CAB file and and nothing is flagged by the Kasperski engine so it looks like
the False Positive has been corrected.

Thanks for the reply.
I just again updated the def and there is no longer a problem. They fixed it.
 
Yep, I did send those files to VirusTotal but haven't notified Kaspersky yet.
I was using the on-demand scanner that you gave directions for several weeks
ago, thanks for doing that.
(Mwave and wget)
Neither AdAware or ZAPro finds any problems.
Should I send the whole .dlls or just their names?

You _must_ send them a copy of the DLL file, preferably zipped.
Explain in your emal what happened.

Art

http://home.epix.net/~artnpeg
Free antivirus:
http://www.ik-cs.com/programs/virtools/KASFX.EXE
http://www.claymania.com/KASFX.EXE
http://tinyurl.com/azzkc
 
From: "Buffalo" <eric(nospam)@nada.com.invalid>

|
|
| Thanks for the reply.
| I just again updated the def and there is no longer a problem. They fixed it.
|

That another PLUS for Kasperski. Very quick fixes on False Positives.
Lately, all indications are leading to the conclusion that Kasperski is the #1 AV solution
in the industry.
 
That another PLUS for Kasperski. Very quick fixes on False Positives.
Lately, all indications are leading to the conclusion that Kasperski is the #1 AV solution
in the industry.

Yep, those vodka drinkers are fast in spitting out solutions for all
sorts. They're great! I have a licese for Kaspersky Lab for years. I
continue to use them on many of my machines. NOD32 for my laptop
though.
 
Art said:
You _must_ send them a copy of the DLL file, preferably zipped.
Explain in your emal what happened.

Art

They asked me to send them, so I just did. I did not zip them. The four files,
that I could attach,were all .dll files.
CDDBUIWinamp.dll,as.dll,MSNForIE.dll and CCWEBWND.dll.

The other two files were in the C:\Windows\Downloaded Program Files and were not
available. (Protected)

However, since I updated the defs within the last hour, a new scan came up
clean.
I believe they have corrected the problem.
 
Ian Kenefick said:
The false positive was probably caused by additional 'heuristic'
signatures designed to identify code attempting to exploit the
recently discovered vulnerability within KAV engine and CAB scanning
(HEAP OVERFLOW).

A patch for this vulnerability is scheduled for release tomorrow. I
imagine the signatures will be removed shortly after this to minimise
the false positives.

See http://www.kaspersky.com/news?id=171512144 for more information. I
hope I have cleared this up :)

Thanks.
 
From: "Buffalo" <eric(nospam)@nada.com.invalid>

|

|
| Thanks for the reply.
| I just again updated the def and there is no longer a problem. They fixed it.
|

That another PLUS for Kasperski.

Kaspersky. With a "y" and not a "i". I wouldn't mention a mere typo
but you've misspelled it repeatedly :)
Very quick fixes on False Positives.
Lately, all indications are leading to the conclusion that Kasperski is the #1 AV solution
in the industry.

Lately? It's been that way for years. It's especially good for on-
demand scanning. It handles various unusual run time packers and
multiply packed files designed to fool av. Plus various archiving and
compression methods. Pefect av for safe hexers. If KAV can't scan
"within", you delete the file. But that rarely happens. It also rarely
happens that another av will find malware KAV doesn't. That makes it
the #1 choice for emergency use as well.

Speaking of KAV, I just took a look at KAVDOS32 in conjuction with
the twenty rogue files I listed in a different thread which contain
Adware and in some cases Trojans. It ripped them all apart and found
all the same malware that up-to-date Windows versions do. Pretty
amazing for a old obsolete DOS scanner that hasn't been supported
by Kaspersky in ages.

I got to thinking about a small download of KAVDOS32 for scanning
download folders only. In fact, I put together a package containing
wget and a batch file as well. It updates and then invokes a command
line as: KAVDOS32 C:\DOWNLOAD

KAVDOS32 is much slower than the GUI version scanners, and it's
unsuitable for scanning the drives of NT based OS. But for users
looking for a free way to use KAV to scan just a d/l folder it should
be ok. The main advantage would be a smaller download compared
to a GUI version. It would offer users with a clue more flexibility
in terms of options compared to the eScan util. They could modify
both the batch and the PRF (Program Reference File) to suit their
tastes.

For anyone who wants to play with this, start by Googling up
KAVDOS32.RAR and extract to c:\kav Then Google up the
Windows version of WGET.EXE and copy it to the same folder.
Create the following batch file in Notepad:
*****************************************
@echo off
cls
echo -----------------------------------------------
echo Updating using updates1 ftp site
echo -----------------------------------------------
wget -N ftp://updates1.kaspersky-labs.com/updates_x/*.avc
wget -N ftp://updates1.kaspersky-labs.com/updates_x/avp.*
cls
kavdos32 c:\download
****************************************
Name it KAVDL.BAT and Save it also to the same folder.
Drag the icon of KAVDL.BAT out to the desktop. Double
click on it any time you want to scan some new file in c:\download
Remember to keep an eye on the action. KAV will display what it's
doing. Again, if KAV doesn't seem to be ripping apart the archive
or Setup file, delete the download.

Art

http://home.epix.net/~artnpeg
Free antivirus:
http://www.ik-cs.com/programs/virtools/KASFX.EXE
http://www.claymania.com/KASFX.EXE
http://tinyurl.com/azzkc
 
From: "Art" <[email protected]>

< snip >


| Speaking of KAV, I just took a look at KAVDOS32 in conjuction with
| the twenty rogue files I listed in a different thread which contain
| Adware and in some cases Trojans. It ripped them all apart and found
| all the same malware that up-to-date Windows versions do. Pretty
| amazing for a old obsolete DOS scanner that hasn't been supported
| by Kaspersky in ages.
|
| I got to thinking about a small download of KAVDOS32 for scanning
| download folders only. In fact, I put together a package containing
| wget and a batch file as well. It updates and then invokes a command
| line as: KAVDOS32 C:\DOWNLOAD
|
| KAVDOS32 is much slower than the GUI version scanners, and it's
| unsuitable for scanning the drives of NT based OS. But for users
| looking for a free way to use KAV to scan just a d/l folder it should
| be ok. The main advantage would be a smaller download compared
| to a GUI version. It would offer users with a clue more flexibility
| in terms of options compared to the eScan util. They could modify
| both the batch and the PRF (Program Reference File) to suit their
| tastes.
|
| For anyone who wants to play with this, start by Googling up
| KAVDOS32.RAR and extract to c:\kav Then Google up the
| Windows version of WGET.EXE and copy it to the same folder.
| Create the following batch file in Notepad:
| *****************************************
| @echo off
| cls
| echo -----------------------------------------------
| echo Updating using updates1 ftp site
| echo -----------------------------------------------
| wget -N ftp://updates1.kaspersky-labs.com/updates_x/*.avc
| wget -N ftp://updates1.kaspersky-labs.com/updates_x/avp.*
| cls
| kavdos32 c:\download
| ****************************************
| Name it KAVDL.BAT and Save it also to the same folder.
| Drag the icon of KAVDL.BAT out to the desktop. Double
| click on it any time you want to scan some new file in c:\download
| Remember to keep an eye on the action. KAV will display what it's
| doing. Again, if KAV doesn't seem to be ripping apart the archive
| or Setup file, delete the download.
|
| Art
|
| http://home.epix.net/~artnpeg
| Free antivirus:
| http://www.ik-cs.com/programs/virtools/KASFX.EXE
| http://www.claymania.com/KASFX.EXE
| http://tinyurl.com/azzkc

Thanx Art !

I just scripted another Multi AV Scanning Tool module using this command line scanner. I
just haven't integrated it into the menu yet. Not sure if I want to especially since I
don't know how it will handle a directory path > 127 chars. (deep folders and/or combination
of long file names and long file named folders)

Since it is a DOS program the command line has a problem when it is given a long directory
name (just like Sophos SWEEP.EXE does). However, using the following COM object code
snippet I can easily convert the long directory name to its 8.3 nameing convention
version...

if len($folder)>2
$objFSO=CreateObject("Scripting.FileSystemObject")
$objFolder=$objFSO.GetFolder($folder)
$folder=$objFolder.ShortPath
endif

This way it can scan just a folder like; "c:\My Documents"

The command line switches are a bit confusing. I can't really tell what is the default and
what switches need to be enabled for agressive scanning.
 
| Speaking of KAV, I just took a look at KAVDOS32 in conjuction with
| the twenty rogue files I listed in a different thread which contain
| Adware and in some cases Trojans. It ripped them all apart and found
| all the same malware that up-to-date Windows versions do. Pretty
| amazing for a old obsolete DOS scanner that hasn't been supported
| by Kaspersky in ages.
|
| I got to thinking about a small download of KAVDOS32 for scanning
| download folders only. In fact, I put together a package containing
| wget and a batch file as well. It updates and then invokes a command
| line as: KAVDOS32 C:\DOWNLOAD
|
| KAVDOS32 is much slower than the GUI version scanners, and it's
| unsuitable for scanning the drives of NT based OS. But for users
| looking for a free way to use KAV to scan just a d/l folder it should
| be ok. The main advantage would be a smaller download compared
| to a GUI version. It would offer users with a clue more flexibility
| in terms of options compared to the eScan util. They could modify
| both the batch and the PRF (Program Reference File) to suit their
| tastes.
|
| For anyone who wants to play with this, start by Googling up
| KAVDOS32.RAR and extract to c:\kav Then Google up the
| Windows version of WGET.EXE and copy it to the same folder.
| Create the following batch file in Notepad:
| *****************************************
| @echo off
| cls
| echo -----------------------------------------------
| echo Updating using updates1 ftp site
| echo -----------------------------------------------
| wget -N ftp://updates1.kaspersky-labs.com/updates_x/*.avc
| wget -N ftp://updates1.kaspersky-labs.com/updates_x/avp.*
| cls
| kavdos32 c:\download
| ****************************************
| Name it KAVDL.BAT and Save it also to the same folder.
| Drag the icon of KAVDL.BAT out to the desktop. Double
| click on it any time you want to scan some new file in c:\download
| Remember to keep an eye on the action. KAV will display what it's
| doing. Again, if KAV doesn't seem to be ripping apart the archive
| or Setup file, delete the download.
Thanx Art !

I just scripted another Multi AV Scanning Tool module using this command line scanner. I
just haven't integrated it into the menu yet. Not sure if I want to especially since I
don't know how it will handle a directory path > 127 chars. (deep folders and/or combination
of long file names and long file named folders)

Since it is a DOS program the command line has a problem when it is given a long directory
name (just like Sophos SWEEP.EXE does). However, using the following COM object code
snippet I can easily convert the long directory name to its 8.3 nameing convention
version...

if len($folder)>2
$objFSO=CreateObject("Scripting.FileSystemObject")
$objFolder=$objFSO.GetFolder($folder)
$folder=$objFolder.ShortPath
endif

This way it can scan just a folder like; "c:\My Documents"

The command line switches are a bit confusing. I can't really tell what is the default and
what switches need to be enabled for agressive scanning.

Well, I'm glad to see you're interested in looking at the
possibilities. It's been a long time since I've used KAVDOS32. I'm
pretty sure it uses (relies on) the INI and PRF files if no switches
are set. Setting command line switches override the PRF option
setting(s) IIRC. It is confusing, and I used to run checks on sample
files to make sure I had the options set the way I wanted them.

Basically, just modify the default PRF settings, changing some of
the No settings to Yes. I rarely used the redundant scan setting
but you would, of course, if you want to scan just a folder with
the most paranoid setup options. I believe with KAV, that setting
causes it to scan the entire file ... and it takes much longer.
Heuristics are on by default.

Let me know if you continue to have problems with settings.
I'll be happy to try to help.

Art

http://home.epix.net/~artnpeg
Free antivirus:
http://www.ik-cs.com/programs/virtools/KASFX.EXE
http://www.claymania.com/KASFX.EXE
http://tinyurl.com/azzkc
 
Since it is a DOS program the command line has a problem when it is given a long directory
name (just like Sophos SWEEP.EXE does). However, using the following COM object code
snippet I can easily convert the long directory name to its 8.3 nameing convention
version...

BTW, I just remembered a registry hack that people used to do with
F-Prot DOS. It gives users the ability to simply right click on any
folder to scan it. Here's Uzi's methods (starting at item 7.):

http://www.uzipaz.com/eng/f-prot.html

Art

http://home.epix.net/~artnpeg
Free antivirus:
http://www.ik-cs.com/programs/virtools/KASFX.EXE
http://www.claymania.com/KASFX.EXE
http://tinyurl.com/azzkc
 
From: "Art" <[email protected]>



|
| Well, I'm glad to see you're interested in looking at the
| possibilities. It's been a long time since I've used KAVDOS32. I'm
| pretty sure it uses (relies on) the INI and PRF files if no switches
| are set. Setting command line switches override the PRF option
| setting(s) IIRC. It is confusing, and I used to run checks on sample
| files to make sure I had the options set the way I wanted them.
|
| Basically, just modify the default PRF settings, changing some of
| the No settings to Yes. I rarely used the redundant scan setting
| but you would, of course, if you want to scan just a folder with
| the most paranoid setup options. I believe with KAV, that setting
| causes it to scan the entire file ... and it takes much longer.
| Heuristics are on by default.
|
| Let me know if you continue to have problems with settings.
| I'll be happy to try to help.
|
| Art
|
| http://home.epix.net/~artnpeg
| Free antivirus:
| http://www.ik-cs.com/programs/virtools/KASFX.EXE
| http://www.claymania.com/KASFX.EXE
| http://tinyurl.com/azzkc

The Multi-AV Vendor scanning tool has now been updated to use the Kaspersky Command Line
Scanner and is available through the menu.

The latest version of the Multi AV scanning tool is now available at..
http://www.ik-cs.com/programs/virtools/Multi_AV.exe
 
Back
Top