Jump to content

Virus not detected when scanning entire disk - only specific folder


Tino
 Share

Recommended Posts

Hi,

 

I just randomly ran a scan of my "Download" folder (C:\Users\Tino\Downloads), just to find a trojan lurking in the bottom of the folder in a zip file. Been there since 2016, I guess it didn't do any damage yet. However, I regularly scan my PC, and just ran a custom scan of my entire C-disk again. Eset doesn't find that malware if I run the big scan, how is that possible?

 

Unfortunately my ESET is in German, if you want me to post logs I can, but I guess they won't help much...  

Link to comment
Share on other sites

  • Administrators

Please gather logs with ELC and provide me with the generated archive for perusal.

Threats in archives do not pose any risk unless the malicious file are extracted at which point they are scanned by real-time protection. Also web access protection scans inside archives, therefore any such threats should be detected and removed upon download.

Link to comment
Share on other sites

  • Administrators

C:\Users\Tino\Downloads\savilerow-1.6.4-windows.zip » ZIP » savilerow-1.6.4-windows/bin/minion.exe - a variant of Win32/Kryptik.AI trojan - action selection postponed until scan completion    

The Kryptik.AI detection is from 2008 so it could be a false positive. Please submit the zip file to ESET as per the instructions at https://support.eset.com/kb141/. If too big to email it, upload it to Dropbox, OneDrive, etc. and provide only a download link.

Link to comment
Share on other sites

Will do! Thank you for your help.

But whether it is a false positive or not, shouldn't ESET detect it as malware regardless of the scope of the scan performed? How come it is only detected when scanning the respective folder directly? This makes me doubt ESET's ability to detect malware on a regular basis, performing broad scans regularly.

Link to comment
Share on other sites

  • Most Valued Members
16 minutes ago, Tino said:

Will do! Thank you for your help.

But whether it is a false positive or not, shouldn't ESET detect it as malware regardless of the scope of the scan performed? How come it is only detected when scanning the respective folder directly? This makes me doubt ESET's ability to detect malware on a regular basis, performing broad scans regularly.

Indeed ESET should detect it whether you told ESET to scan the whole computer or just the folder that contains the threat , there is something wrong here.

Link to comment
Share on other sites

  • Administrators

"Smart scan" doesn't scan inside archives by default. Maybe you used a custom or context-menu scan with archives enabled when the file was detected.

Link to comment
Share on other sites

28 minutes ago, Marcos said:

"Smart scan" doesn't scan inside archives by default. Maybe you used a custom or context-menu scan with archives enabled when the file was detected.

That's good to know...! I think I used a context-menu scan when the file was detected (I right clicked the folder and told eset to scan it).

Well, I guess if only archives are excluded in the smart scan then it won't do much harm if malware isn't detected, since the malware isn't 'active'. Still, I find it a bit odd that archives are excluded in the first place.

Link to comment
Share on other sites

  • Most Valued Members
1 hour ago, Tino said:

That's good to know...! I think I used a context-menu scan when the file was detected (I right clicked the folder and told eset to scan it).

Well, I guess if only archives are excluded in the smart scan then it won't do much harm if malware isn't detected, since the malware isn't 'active'. Still, I find it a bit odd that archives are excluded in the first place.

Do a custom scan and set it to scan everything including the archives.

Scanning archives will make the scan take longer time.

Link to comment
Share on other sites

  • Administrators
2 hours ago, Tino said:

Still, I find it a bit odd that archives are excluded in the first place. 

Smart scan is meant to be fast and to detect malicious files that can be executed right away.

On the other hand, if one needs to scan the machine thoroughly he or she can use the In-depth scan profile which has scanning of archives enabled.

Link to comment
Share on other sites

Rami, Marcos, makes total sense. Is it possible to schedule a custom-scan? I can only select "on-demand" scan when scheduling scans, which is a smart scan I suppose. 

Link to comment
Share on other sites

  • Most Valued Members
34 minutes ago, Tino said:

Rami, Marcos, makes total sense. Is it possible to schedule a custom-scan? I can only select "on-demand" scan when scheduling scans, which is a smart scan I suppose. 

It's explained here : https://support.eset.com/kb3207/?viewlocale=en_US

You could make custom scan with your prefered settings and then add it to the Scheduler.

Link to comment
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...