Jump to content

Marcos

Administrators
  • Posts

    36,133
  • Joined

  • Last visited

  • Days Won

    1,439

Posts posted by Marcos

  1. 6 hours ago, WhiskeyRiver said:

    I suspect the eset programmers solved it once they confirmed that turning HIPS off cured it.

    So one of the laptops got extensive scrutiny and was finally solved by putting it the pre-release eset update channel after the programmers had their way with it.

    We didn't change anything with regard to the issue and are currently anticipating more information / resolution from Microsoft.

  2. You don't have to care what action was exactly performed, otherwise you'd have to distinguish between clean files infected with a parasitic virus and other kind of threats that contains only malicious code.

    The point is that cleaning means removing the malicious code, ie. either the whole file or the malicious code added to otherwise legitimate files and also removing all references to the malicious file from the registry. A copy of the original file is always put into quarantine so that it could be restored later, if needed.

  3. Cleaning means:
    1, placing a copy of the original file to quarantine
    2, deleting the whole malicious file or cleaning the malicious code in case of VBA macro malware or sanitizing the file in case of file infectors (viruses)
    3, removing references to the malicious file from the registry as well as fixing possibly malicious modifications in the registry.

  4. 10 minutes ago, Dick said:

    I have exactly the same issue.
    The problems started after upgrade to 1803 on May 5 2018.
    It has been restarted several times since then.
    Below is a summary of the ESET events since the "Feature update to Windows 10, version 1803" was installed.
    No such errors prior to that date..
    As this has been reported several times during the past weeks I wonder what the solution is (if any).

    Microsoft is already analyzing the issue. Does temporarily disabling protected service and rebooting the machine make a difference or the issue returns after a while?

  5. The blocked address is likely related to CoinMiner. If you are still getting the notification about blocked access to the url, email samples[at]eset.com and enclose the archive generated by ELC (or a download link to it) as well as a description of the problem.

  6. 9 minutes ago, claudiu said:

    OK then, that means 23 from 66 antiviruses on Virus Total must be stupid to classify this as "Trojan" when in fact  doesn't pose any security risk.

    Correct. Sometimes even > 40 AVs in VT report even perfectly benign files as malware. That is also the reason why VirustTotal has the following listed among best practices:

    The data generated by VirusTotal should not be used automatically as the unique means to blacklist/produce signatures for files. i.e. Antivirus vendors should not copy the signatures generated by other vendors without any other scrutinizing on their side.

    Almost all AVs detect the file with generic detection names so they are not detections based on manual analysis of the file by researchers and therefore are not accurate.

    By the way, here is how the game hack tool looks like when run:

    image.png

×
×
  • Create New...