Jump to content
Tino

Virus not detected when scanning entire disk - only specific folder

Recommended Posts

Hi,

 

I just randomly ran a scan of my "Download" folder (C:\Users\Tino\Downloads), just to find a trojan lurking in the bottom of the folder in a zip file. Been there since 2016, I guess it didn't do any damage yet. However, I regularly scan my PC, and just ran a custom scan of my entire C-disk again. Eset doesn't find that malware if I run the big scan, how is that possible?

 

Unfortunately my ESET is in German, if you want me to post logs I can, but I guess they won't help much...  

Share this post


Link to post
Share on other sites

Please gather logs with ELC and provide me with the generated archive for perusal.

Threats in archives do not pose any risk unless the malicious file are extracted at which point they are scanned by real-time protection. Also web access protection scans inside archives, therefore any such threats should be detected and removed upon download.

Share this post


Link to post
Share on other sites

Thank you for your quick answer. Do I just attach the file here or do I send it to you via pn?

Share this post


Link to post
Share on other sites

You can post it here. Only moderators have access to attachments.

Share this post


Link to post
Share on other sites

Perfect. Here it is:

 

Edited by Tino

Share this post


Link to post
Share on other sites

C:\Users\Tino\Downloads\savilerow-1.6.4-windows.zip » ZIP » savilerow-1.6.4-windows/bin/minion.exe - a variant of Win32/Kryptik.AI trojan - action selection postponed until scan completion    

The Kryptik.AI detection is from 2008 so it could be a false positive. Please submit the zip file to ESET as per the instructions at https://support.eset.com/kb141/. If too big to email it, upload it to Dropbox, OneDrive, etc. and provide only a download link.

Share this post


Link to post
Share on other sites

Will do! Thank you for your help.

But whether it is a false positive or not, shouldn't ESET detect it as malware regardless of the scope of the scan performed? How come it is only detected when scanning the respective folder directly? This makes me doubt ESET's ability to detect malware on a regular basis, performing broad scans regularly.

Share this post


Link to post
Share on other sites
16 minutes ago, Tino said:

Will do! Thank you for your help.

But whether it is a false positive or not, shouldn't ESET detect it as malware regardless of the scope of the scan performed? How come it is only detected when scanning the respective folder directly? This makes me doubt ESET's ability to detect malware on a regular basis, performing broad scans regularly.

Indeed ESET should detect it whether you told ESET to scan the whole computer or just the folder that contains the threat , there is something wrong here.

Share this post


Link to post
Share on other sites

"Smart scan" doesn't scan inside archives by default. Maybe you used a custom or context-menu scan with archives enabled when the file was detected.

Share this post


Link to post
Share on other sites
28 minutes ago, Marcos said:

"Smart scan" doesn't scan inside archives by default. Maybe you used a custom or context-menu scan with archives enabled when the file was detected.

That's good to know...! I think I used a context-menu scan when the file was detected (I right clicked the folder and told eset to scan it).

Well, I guess if only archives are excluded in the smart scan then it won't do much harm if malware isn't detected, since the malware isn't 'active'. Still, I find it a bit odd that archives are excluded in the first place.

Share this post


Link to post
Share on other sites
1 hour ago, Tino said:

That's good to know...! I think I used a context-menu scan when the file was detected (I right clicked the folder and told eset to scan it).

Well, I guess if only archives are excluded in the smart scan then it won't do much harm if malware isn't detected, since the malware isn't 'active'. Still, I find it a bit odd that archives are excluded in the first place.

Do a custom scan and set it to scan everything including the archives.

Scanning archives will make the scan take longer time.

Share this post


Link to post
Share on other sites
2 hours ago, Tino said:

Still, I find it a bit odd that archives are excluded in the first place. 

Smart scan is meant to be fast and to detect malicious files that can be executed right away.

On the other hand, if one needs to scan the machine thoroughly he or she can use the In-depth scan profile which has scanning of archives enabled.

Share this post


Link to post
Share on other sites

Rami, Marcos, makes total sense. Is it possible to schedule a custom-scan? I can only select "on-demand" scan when scheduling scans, which is a smart scan I suppose. 

Share this post


Link to post
Share on other sites
34 minutes ago, Tino said:

Rami, Marcos, makes total sense. Is it possible to schedule a custom-scan? I can only select "on-demand" scan when scheduling scans, which is a smart scan I suppose. 

It's explained here : https://support.eset.com/kb3207/?viewlocale=en_US

You could make custom scan with your prefered settings and then add it to the Scheduler.

Share this post


Link to post
Share on other sites

Got it Rami! Thank you.

Share this post


Link to post
Share on other sites
7 minutes ago, Tino said:

Got it Rami! Thank you.

You are welcome ;)

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.

×