VAZ Synths

jasco · Post by **jasco** » Mon Nov 28, 2011 8:42 am

Hi,

My BT NetProtect Plus (McAfee) seems to think the latest Vaz 2010 installer contains a trojan called 'Artemis!824F3E929C66'? Is anybody else having issues?

hersoot · Post by **hersoot** » Mon Nov 28, 2011 9:09 am

I had the same thing happen when installing the demos for Vaz 2010 and Vaz Plus. The trojan was detected by McAfee in the standalone .exe file.

ThoughtExperiment · Post by **ThoughtExperiment** » Tue Dec 06, 2011 1:55 pm

Same here, with the latest full version of VAZ2010 exe file (detected in my case by BitDefender). Going back to the beta version(v210b4) for now, which seemed to be OK and for which, luckily, I hadn't yet got around to deleting the installer.

Any news/views on this, MadGav? Could it be a false positive if three different AV checkers picked up on it?

MadGav · Post by **MadGav** » Tue Dec 06, 2011 8:41 pm

I'm investigating this, the McAfee match I believe is "heuristic" which I take to mean that the exe smells bad. Now it's got no more than a few lines of code which isn't Delphi base libraries... worst case I'll have to abandon the stub + dll approach.

Martin

MadGav · Post by **MadGav** » Tue Dec 06, 2011 10:32 pm

A little more investigation... I've discovered that Delphi produces unique exe files every time you compile. The released 2.10 Vaz2010.exe file sets off a load of A/V as reported, a straight rebuild which differs in a few bytes (which I believe are a repeated timestamp) triggers much much less. I think this demonstrates that the exe released is *not* malware. But *head* *desk*, still a question of *how* to avoid this kind of problem

Martin

EvilDragon · Post by **EvilDragon** » Tue Dec 06, 2011 10:52 pm

Every good AV will let you add an exception for anything that it reports...

ThoughtExperiment · Post by **ThoughtExperiment** » Thu Dec 08, 2011 9:12 pm

So it looks like a false alarm, thanks for looking into this - don't give yourself too much of a headache

paulstapp · Post by **paulstapp** » Fri Mar 30, 2012 1:12 am

The trojan problem seems to be solved and replaced with rare software problem "We are blocking your sofware cause it is rare." Both Norton 360 and avast! had this problem. (makes me real mad -- Lazy SOB's).I couldn't find a way for norton 360 to let it pass. Avast! let me let it pass.

MadGav · Post by **MadGav** » Mon Apr 02, 2012 8:17 pm

mikusan wrote:Same here, with the latest full version of VAZ2010 exe file (detected in my case by BitDefender). Going back to the beta version(v210b4) for now, which seemed to be OK and for which, luckily, I hadn't yet got around to deleting the installer.

Any news/views on this, MadGav? Could it be a false positive if three different AV checkers picked up on it?

FYI VAZ 2010 v2.1.3a scanned clear with BitDefender yesterday. I've had some false positive reports accepted by Symantec and Avira over the last few days, going to throw one at BitDefender now.

Martin

VAZ Synths

KVR Audio

Vaz 2010 v2.10 trojan?