Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Ramnit Trojan in AdwCleaner-installer from Bleeping Computer


  • Please log in to reply
7 replies to this topic

#1 UKPCDK

UKPCDK

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Denmark
  • Local time:05:39 PM

Posted 20 January 2016 - 04:50 PM

Hello all.

Today I wanted to download AdwCleaner from http://www.bleepingcomputer.com/download/adwcleaner/ and my antivirus prg. Reason Core Security found the installer to contain a trojan called Ramnit.

When I googled "malware ramnit adwcleaner" several sites came up with warnings about AdwCleaner containing malware, and BleepingComputer.com is also mentioned as from where infected installer has been downloaded.
From here for instance: https://www.reasoncoresecurity.com/adwcleaner.exe-de6d03ad17736f57d3c351ff11c4d93775cfac1f.aspx

My AVG didn't catch it when I scanned the installer before activating it, nether did Microsoft Security Essentials.
(AVG reported that the scanning included 22 items, but MSE only scanned 15 items)

I didn't scan it with Reason Core, but Reason Core caught it when I activated the installer.

-UKPCDK

 



BC AdBot (Login to Remove)

 


#2 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,750 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:12:39 PM

Posted 20 January 2016 - 05:12 PM

Reason Core says...Clean (as of last analysis). I also downloaded AdwCleaner today and the file is safe.

Bleeping Computer's hosted programs for download are trustworthy, safe and malware-free. However depending on the product some anti-virus software and other security scanners may flag certain programs as a threat for a variety of reasons when that is not the case.

Let me explain why....certain embedded files that are part of legitimate programs and specialized fix tools (like AdwCleaner), may at times be detected by some anti-virus and anti-malware scanners as suspicious, a Risk Tool, Hacking Tool, Potentially Unwanted Program, a possible threat or even Malware (virus/trojan) when that is not the case. This occurs for a variety of reasons to include the tool's compiler, the files it uses, whether files are compressed or packed, what behavior (routines, scripts, etc) it performs, any registry strings it may contain and the type of security engine that was used during the scan. Other legitimate files which may be obfuscated, encrypted or password protected in order to conceal itself so they do not allow access for scanning but often trigger alerts by anti-virus software.

When flagged by an anti-virus or security scanner, it's because the program includes features, behavior or files that appear suspicious or which can potentially be used for malicious purposes. Compressed and packed files in particular are often flagged as suspicious by security software because they have difficulty reading what is inside them. These detections do not necessarily mean the file is malicious or a bad program. It means it has the potential for being misused by others or that it was simply detected as suspicious or a threat due to the security program's heuristic analysis engine which provides the ability to detect possible new variants of malware. Anti-virus scanners cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert you or even automatically remove them. In these cases the detection is a "false positive" and can be ignored.

Most of the well known specialized tools we use against malware are written by experts/Security Colleagues at various security forums like Bleeping Computer, TechSupport, GeeksToGo, SypwareInfo and other similar sites so they can be trusted...this includes any program hosted by BC for download. Unfortunately, many of these tools are falsely detected by various anti-virus programs from time to time for the reasons noted above. This in turn sometimes results in an inaccurate site rating/warning of potentially dangerous software when that is not the case.

The problem is really with the anti-virus vendors who keep targeting these embedded files and NOT with the tools themselves. We can inform the developers but they have encountered this issue many times before and in most cases there isn't much they can do about it. Once the detection is reported to the anti-virus vendor, they are usually quick to fix it by releasing an updated definition database.

Either have your anti-virus ignore the detection or temporarily disable it until you download and run the tool.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#3 Agouti

Agouti

  • Members
  • 1,548 posts
  • OFFLINE
  •  
  • Local time:12:39 PM

Posted 20 January 2016 - 05:33 PM

It's a false positive.  Also, running AVG and MSE together is not recommended.  You should only ever run one resident antivirus at any time.



#4 UKPCDK

UKPCDK
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Denmark
  • Local time:05:39 PM

Posted 20 January 2016 - 05:34 PM

Hi Quietman7

I generally trust BC and that is also why I chose BC for downloading AdwCleaner, and if my antivirus detect anything when downloading I use to search for info about false positive readings on the program I am downloading.
In this case I didn't get any info that could verify that this was a false positive, but instead I got a lot of hits about AdwCleaner containing Ramnit adware. And when I saw this site mentioned, I simply didn't dare to ignore the detection and decided to write a topic about it so I could warn other users, or get info about it being safe if it in fact was a false positive.

Thank you for the explanation.

-UKPCDK



 



#5 UKPCDK

UKPCDK
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Denmark
  • Local time:05:39 PM

Posted 20 January 2016 - 05:40 PM

Hi  Agouti.

 

You should only ever run one resident antivirus at any time.

Thank you for the advise.

The Reason Core Security should be OK to use along with other antivirus prg's.
But not MSE? Then I might have to buy the full version of AVG, because it doesn't include a firewall in the free-version.

-UKPCDK



#6 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,750 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:12:39 PM

Posted 20 January 2016 - 05:55 PM

...In this case I didn't get any info that could verify that this was a false positive, but instead I got a lot of hits about AdwCleaner containing Ramnit adware...

You have to be careful when conducting searches on the Internet as there is a lot of useless and misinformation out there especially in regards to malware removal assistance (and removal guides). It is not unusual to find numerous hits from untrustworthy and scam sites which mis-classify detections or provide misleading information. This is deliberately done more as a scam to entice folks into buying an advertised fix or removal tool. Scammers take advantage of novice users and entice them into downloading junk software using gimmicks, false claims and other deceptive advertising. In some cases if the fix is a free download, users may be enticed to download dubious software, malicious files or even be redirected to a malicious web site. When performing search queries, always check multiple sources to confirm the information provided is safe, consistent and from trustworthy web sites. If still in doubt, just post here like you did in this case.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#7 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,750 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:12:39 PM

Posted 20 January 2016 - 05:57 PM

...But not MSE? Then I might have to buy the full version of AVG, because it doesn't include a firewall in the free-version.

See the IMPORTANT NOTE about not using more than one anti-virus program in this topic.

Most Internet Security products include antivirus and firewall protection plus various other features depending on the software vendor...and for those reasons it is called a Security suite.

I'm not an advocate of suites. All-in-one tools and suites are filled with extra features (including "bells & whistles") which typically use more system resources than separate programs that do the same task while other suites leave a much smaller footprint. Suites tend to have varying degrees of strengths and weaknesses accorded for each feature they incorporate. Internet Security Suites include a Firewall component, which IMO is unnecessary since the Windows built-in firewall is one of the best and provides adequate protection. Further, many folks also use a router which is essentially a hardware firewall.

In contrast, separate tools are designed, built and maintained with a greater focus in a specific area so they are generally of better quality and more effective at what they are designed to do. This means the program's performance for that particular feature is usually superior than their all-in-one counterpart. Further, all-in-one tools generally do not allow the user as much flexibility in tailoring program settings and usage.If you are adamant about using a suite, then I would recommend one of the following:
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#8 Agouti

Agouti

  • Members
  • 1,548 posts
  • OFFLINE
  •  
  • Local time:12:39 PM

Posted 20 January 2016 - 06:04 PM

UKPCDK, I see Quietman has already posted an answer.  I will leave you in his capable hands.  You couldn't want better advice than you are getting.






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users