Suspicious scan results "QUICKBATCH".

[autobotranger 1]

Hello everyone.

Since updating Windows 10 to version 1809 and Eset Nod32 Antivirus to version 12.0.31.0 I've noticed some interesting results in the log after performing a full system scan. I'm fully aware that all results that show up in yellow text is currently in use by the OS or other programs, and should be safe, but these particular entries I'm a little suspicious about due to Eset's description of them:

The results I've marked translate from Danish to English as follows: "QUICKBATCH - error - unknown compression method."

What's interesting is that prior to yesterdays Windows 10 patch Tuesday update bringing my OS to version 17763.253, Nod32 only showed 2 of these entries in the scan logs, but now it shows 4 of them. While results shown in yellow text should be safe, it's the classification as QUICKBATCH I'm concerned about https://www.virusradar.com/en/search/all/quickbatch

Are these just harmless Windows 10  system files, hence why Eset doesn't show them in red, or is this something we should take a look at?

Thanks in advance.

 

BUMP* Turns out there was 2 other detections in the same scan log. Sorry for missing them:

 

Edited January 10, 2019 by autobotranger
Missed something.

[Marcos 5,070]

Please upload the files in question to a safe location and provide a download link.

[autobotranger 1]

5 hours ago, Marcos said:

Please upload the files in question to a safe location and provide a download link.

I've PM'd you the download link for the various files. If they don't work let me know and I'll upload them elsewhere.

Also it would seem that I missed 2 "QUICKBATCH" entries in the prior scan log:

It turns out there is also 2 entries for "QUICKBATCH" for the two Windows10.0-KB4480116x64.cab detections.

Pretty sure that one is from yesterdays patch Tuesday update.

Sorry for missing it in my first post.

[autobotranger 1]

Hello again. Do we have an update in regards to these "QUICKBATCH" detections?

It's worth noting that I have checked all the files in question on VirusTotal and they all came out green. I have always used HitmanPro to check them and the rest of the PC and it doesn't pick up anything either. 

Thanks in advance.

[Marcos 5,070]

2 hours ago, autobotranger said:

Do we have an update in regards to these "QUICKBATCH" detections?

Not yet. The developer will respond me when he finishes other tasks with higher priority. Looking at one of the files I assume that they were misidentified as generated by QuickBatch but for the final statement we'll need to wait for the developer.

[autobotranger 1]

1 hour ago, Marcos said:

Not yet. The developer will respond me when he finishes other tasks with higher priority. Looking at one of the files I assume that they were misidentified as generated by QuickBatch but for the final statement we'll need to wait for the developer.

Thanks for the reply. Good to hear that these are being looked at.

[Marcos 5,070]

As I assumed, it appears to be an issue in the unpacker and engine that causes the error message on that file. We are working on a fix. There's no reason to be concerned about since the only negative effect is the error message that is displayed.

[autobotranger 1]

1 hour ago, Marcos said:

As I assumed, it appears to be an issue in the unpacker and engine that causes the error message on that file. We are working on a fix. There's no reason to be concerned about since the only negative effect is the error message that is displayed.

Ah I see, then it should be fine.  Thank you for the update 😃

Would you like me to let you know if any more of these detections starts to appear in the future scan log for files?

[Marcos 5,070]

19 hours ago, autobotranger said:

Would you like me to let you know if any more of these detections starts to appear in the future scan log for files?

That shouldn't be necessary. It will be enough if you confirm that the error is gone after we release Archive module 1283 with a fix.

[Marcos 5,070]

Please confirm that the problem is gone now with the Archive module 1283.

[autobotranger 1]

On 1/29/2019 at 12:38 PM, Marcos said:

Please confirm that the problem is gone now with the Archive module 1283.

Hello again.

After Archive module 1283 was installed the "QUICKBATCH" errors no longer appear in scan logs! So it would seem the problem has been corrected.

I'd say we can mark this as solved 😊