holmegm Posted February 12, 2021 ID:1438333 Share Posted February 12, 2021 Tried to use GVIM on Windows today and it got quarantined as malware. No recent updates to the gvim program that I am aware of. Malwarebytes www.malwarebytes.com -Log Details- Protection Event Date: 2/12/21 Protection Event Time: 8:43 AM Log File: 4cc65c44-6d38-11eb-a8c3-8cec4bd24b02.json -Software Information- Version: 4.3.0.98 Components Version: 1.0.1157 Update Package Version: 1.0.37015 License: Premium -System Information- OS: Windows 10 (Build 19041.746) CPU: x64 File System: NTFS User: System -Blocked Malware Details- File: 1 Malware.AI.3043391, C:\Program Files (x86)\Vim\vim81\gvim.exe, Quarantined, 1000000, 0, 1.0.37015, 647197131A567E17002E703F, dds, 01113876, BDAAAC3FA3F6796825A51EF1C0E5B3FD, 45429C164365C093F1F6BB5A59B0DC83E33505DE3A1355B32F478491C0A1BCF6 (end) Link to post Share on other sites More sharing options...
holmegm Posted February 12, 2021 Author ID:1438336 Share Posted February 12, 2021 The filegvim.zip Link to post Share on other sites More sharing options...
TwinHeadedEagle Posted February 12, 2021 ID:1438339 Share Posted February 12, 2021 Hi, This is indeed a false positive and should be now fixed. Thank you for reporting. Link to post Share on other sites More sharing options...
holmegm Posted February 12, 2021 Author ID:1438344 Share Posted February 12, 2021 Thank you! Link to post Share on other sites More sharing options...
Fwkion Posted February 15, 2021 ID:1438841 Share Posted February 15, 2021 Hi, I got a similar detection. The file has been there for quite some time and the file hash matches the one provided by vim on the website. Malwarebytes www.malwarebytes.com -Log Details- Scan Date: 15/02/2021 Scan Time: 02:00 Log File: 259fe6d8-6f29-11eb-98fb-c49ded91eb87.json -Software Information- Version: 4.3.0.98 Components Version: 1.0.1157 Update Package Version: 1.0.37139 Licence: Premium -System Information- OS: Windows 10 (Build 19041.804) CPU: x64 File System: NTFS User: System -Scan Details- File: 1 Malware.AI.4294464096, C:\USERS\User\DOWNLOADS\GVIM81.EXE, No Action By User, 1000000, 0, 1.0.37139, C220091BDDAD977FFFF85260, dds, 01117404, 14391C74929552DB62ACC6BCA9EFBE1B, 0F613497E909F7140061A0AFA309B5E11A9FF9036B1DEB01CE708987FDB708B9 (end) Link to post Share on other sites More sharing options...
Staff cli Posted February 16, 2021 Staff ID:1439151 Share Posted February 16, 2021 Thanks for reporting, this will be fixed in 10 minutes. Link to post Share on other sites More sharing options...
zdooder Posted February 17, 2021 ID:1439382 Share Posted February 17, 2021 Similarly, I got a Malware Detection, so upgraded to gVim 8.2 and now am getting a detection on that installer: Malwarebytes www.malwarebytes.com -Log Details- Scan Date: 2/17/21 Scan Time: 2:47 AM Log File: 2c810c60-7105-11eb-9c5e-84fdd1a5963b.json -Software Information- Version: 4.3.0.98 Components Version: 1.0.1173 Update Package Version: 1.0.37217 License: Premium -System Information- OS: Windows 10 (Build 19041.804) CPU: x64 File System: NTFS User: System -Scan Summary- Scan Type: Threat Scan Scan Initiated By: Scheduler Result: Completed Objects Scanned: 370124 Threats Detected: 1 Threats Quarantined: 0 Time Elapsed: 6 min, 19 sec -Scan Options- Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Disabled Heuristics: Enabled PUP: Warn PUM: Warn -Scan Details- Process: 0 (No malicious items detected) Module: 0 (No malicious items detected) Registry Key: 0 (No malicious items detected) Registry Value: 0 (No malicious items detected) Registry Data: 0 (No malicious items detected) Data Stream: 0 (No malicious items detected) Folder: 0 (No malicious items detected) File: 1 Malware.AI.257717160, C:\USERS\TROY\DOWNLOADS\GVIM82.EXE, No Action By User, 1000000, 0, 1.0.37217, F356B2108D9EC1960F5C73A8, dds, 01120406, AA84543492CD8260F44A5ACF1EC35641, D63AAC8799C516D30725C27716BBDB6439F02833C80B091423CE95EC592C19C3 Physical Sector: 0 (No malicious items detected) WMI: 0 (No malicious items detected) (end) Link to post Share on other sites More sharing options...
Staff cli Posted February 17, 2021 Staff ID:1439422 Share Posted February 17, 2021 Thanks for reporting, this will be fixed in 10 minutes. Link to post Share on other sites More sharing options...
Recommended Posts