almi Posted May 31, 2021 ID:1460590 Share Posted May 31, 2021 Hello. https://www.virustotal.com/gui/file/b082a911007735255dd33a626fbd434760f5c08f3321a1d9dfc95f7063f893c2/detection File is a loader for starting executable of SMS-Soft ChipTuningPRO software (http://www.sms-soft.ru). We are developing this product and use VMProtect to protect it. File is digitally signed. Please, add to white-list. Link to post Share on other sites More sharing options...
almi Posted May 31, 2021 Author ID:1460591 Share Posted May 31, 2021 File in attachment, password "infected" (without quotes). ctp.zip Link to post Share on other sites More sharing options...
Staff miekiemoes Posted May 31, 2021 Staff ID:1460593 Share Posted May 31, 2021 Hi, I can't reproduce detection. Do you have the detection log? Link to post Share on other sites More sharing options...
almi Posted May 31, 2021 Author ID:1460594 Share Posted May 31, 2021 No, I am based on the virustotal report. Link to post Share on other sites More sharing options...
Staff miekiemoes Posted May 31, 2021 Staff ID:1460595 Share Posted May 31, 2021 The detection doesn't show in Virustotal either anymore. Link to post Share on other sites More sharing options...
almi Posted May 31, 2021 Author ID:1460596 Share Posted May 31, 2021 Ok, thanks! Link to post Share on other sites More sharing options...
almi Posted May 31, 2021 Author ID:1460600 Share Posted May 31, 2021 Hm. Half an hour passed and the report appeared again. Check it. Malwarebytes Malware.AI.2439597818 Link to post Share on other sites More sharing options...
Staff miekiemoes Posted May 31, 2021 Staff ID:1460604 Share Posted May 31, 2021 I don't see it here. Also note, Our engine format and configuration in VirusTotal is different than our consumer and corporate products’ default configuration. In VirusTotal we use a command-line engine with different configuration and detection techniques/heuristics which might detect more than the commercial product. There are also false-positive suppression mechanisms in the commercial product which are not present in the command-line engine in VirusTotal. This file has been whitelisted for our commercial products already and it is not detected anymore. This will eventually fix itself in Virustotal as well, as we don't have control over this. Link to post Share on other sites More sharing options...
Porthos Posted May 31, 2021 ID:1460614 Share Posted May 31, 2021 The Website is blocked as well https://sms-soft.ru Redirects to almisoft.ru which is blocked. Moving to Web FP section for that Link to post Share on other sites More sharing options...
almi Posted May 31, 2021 Author ID:1460616 Share Posted May 31, 2021 3 minutes ago, Porthos said: The Website is blocked as well https://sms-soft.ru Redirects to almisoft.ru which is blocked. Moving to Web FP section for that The almisoft.ru site an clean and not blocked. This redirect is normal. https://www.virustotal.com/gui/url/0961b533e28ed147572731c53e833959ff08a4dc915167168ce70f1598533fe0/detection Link to post Share on other sites More sharing options...
Porthos Posted May 31, 2021 ID:1460618 Share Posted May 31, 2021 2 minutes ago, almi said: The almisoft.ru site an clean and not blocked. It is currently by Malwarebytes and that is the reason I moved your post. Link to post Share on other sites More sharing options...
almi Posted May 31, 2021 Author ID:1460620 Share Posted May 31, 2021 If your antivirus mistakenly detects something that doesn't exist, can you better fix it? Link to post Share on other sites More sharing options...
almi Posted May 31, 2021 Author ID:1460624 Share Posted May 31, 2021 https://www.virustotal.com/gui/url/0961b533e28ed147572731c53e833959ff08a4dc915167168ce70f1598533fe0/detection The almisoft.ru is clean! Link to post Share on other sites More sharing options...
almi Posted May 31, 2021 Author ID:1460627 Share Posted May 31, 2021 Please provide the reason of blocking. What exactly on our site do you consider a Trojan? The site contains software developed by us, which has never had any malicious features. Link to post Share on other sites More sharing options...
Staff JPopovic Posted May 31, 2021 Staff ID:1460631 Share Posted May 31, 2021 Hello, The block will be removed. Thank you for your understanding! Link to post Share on other sites More sharing options...
almi Posted May 31, 2021 Author ID:1460632 Share Posted May 31, 2021 I will allow myself some reasoning. I created an empty project in C++ RAD Studio, with a clean form and one TButton displaying on click "Hello world". Then I protected one function (TForm1:: Button1Click(TObject *Sender)) using VMProtect (in ultra mode, mutation plus virtualization). Your antivirus already finds Malwarebytes Malware.AI.2327300706 in the code. Do you consider this the norm? I can attach all the sources. Link to post Share on other sites More sharing options...
almi Posted May 31, 2021 Author ID:1460633 Share Posted May 31, 2021 At the same time, as a programmer, I perfectly understand the complexity of the task of detecting malwares in code protected by virtual machines. However, I think that the analysis of such code should be carried out more gently if the executable have an non compromised digital signature. Link to post Share on other sites More sharing options...
Porthos Posted May 31, 2021 ID:1460635 Share Posted May 31, 2021 5 minutes ago, almi said: Your antivirus already finds Malwarebytes Malware.AI.2327300706 in the code. The file you attached is not detected by the installed version of Malwarebytes. It is still detected by Virus Total. That VT detection was explained already a few posts ago. Virus Total is having issues reaching the cloud whitelisting server for your software. Whitelists are based in the cloud. Link to post Share on other sites More sharing options...
almi Posted May 31, 2021 Author ID:1460636 Share Posted May 31, 2021 14 minutes ago, JPopovic said: Hello, The block will be removed. Thank you for your understanding! And I thank you for your response! Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now