SRL Archive - General News

Simba Virus Detection, wtf.


Overtime

2011-12-06 00:23:22


I dont know why all of a sudden Avira is picking this up.

I'm sure there is NO MALWARE what so ever in simba but what is it picking up that might be causing this?

Wizzup? ?

This is 977

KingKong

2011-12-06 00:30:27

false alarm, just ignore it? Ive had avira think half my exe files are corrupted.

Overtime

2011-12-06 00:31:17

I know i do ignore it. I have to disable Avira though just for it to run.

Its bs.

KingKong

2011-12-06 00:33:10

From: Overtime
I know i do ignore it. I have to disable Avira though just for it to run.

Its bs.


Im pretty sure you can add an exception for that particular file.

Flight

2011-12-06 00:35:53

How on earth would that get into Simba.exe?

Kave

2011-12-06 01:00:17

http://analysis.avira.com/samples/ upload it?

Overtime

2011-12-06 01:15:11

Just uploaded it Kave, thanks for the suggestion.

Now lets see how long it takes.

grats

2011-12-06 01:15:30

windows 8 built in protector detects that too, I reported it to microsoft though

Wizzup?

2011-12-06 08:14:22

Sounds interesting, although I'm pretty sure there's nothing wrong with mopar's autobuilds, which is the main distribution we've been using for months. :)

I wonder what that Offend.KD.454412.1 even is, though.

Aftermath

2011-12-06 13:14:20

I'd guess it's your auto-updating code that's triggering it, that looks like a generic trojan detection.

Edit: My other guess is that the latest release just happens to have a checksum equal to that of known malware.

nielsie95

2011-12-06 13:28:09

F-Secure Deepguard also detects Simba as malware when I'm compiling it (has done so for a while now, though).

Kave

2011-12-06 15:13:59

Dear Sir or Madam,

Thank you for your email to Avira's virus lab.
Tracking number: INC00911737.

A listing of files alongside their results can be found below:
File ID Filename Size (Byte) Result
26433951 Simba.exe 3.92 MB FALSE POSITIVE


Please find a detailed report concerning each individual sample below:
Filename Result
Simba.exe FALSE POSITIVE

The file 'Simba.exe' has been determined to be 'FALSE POSITIVE'.In particular this means that this file is not malicious but a false alarm.Detection will be removed from our virus definition file (VDF) with one of the next updates.

Alternatively you can see the analysis result here:
http://analysis.avira.com/samples/details.php?uniqueid=7fcgc0sQ207x7xhhTW0k08YRpTFwsNSH&incidentid=911737

An overview of all your submissions can be found here:
http://analysis.avira.com/samples/details.php?uniqueid=7fcgc0sQ207x7xhhTW0k08YRpTFwsNSH

P1nky

2011-12-06 19:16:47

Haha right when i saw this topic, I was like he probably has McAfee.

Overtime

2011-12-06 19:57:27

From: P1nky
Haha right when i saw this topic, I was like he probably has McAfee.



>.> nigga plz.

Thanks Mitch.

I uploaded mine too, but they have yet to send me back my email.

EDIT:

nvm just found it


Dear Sir or Madam,

Thank you for your email to Avira's virus lab.
Tracking number: INC00911741.

A listing of files alongside their results can be found below:
File ID Filename Size (Byte) Result
26433951 Simba.exe 3.92 MB FALSE POSITIVE

Please find a detailed report concerning each individual sample below:
Filename Result
Simba.exe FALSE POSITIVE

The file 'Simba.exe' has been determined to be 'FALSE POSITIVE'.In particular this means that this file is not malicious but a false alarm.Detection will be removed from our virus definition file (VDF) with one of the next updates.
Alternatively you can see the analysis result here:
http://analysis.avira.com/samples/details.php?uniqueid=qscRAdpryBESBRjnkwdwtEUpRBEhXQSM&incidentid=911741

An overview of all your submissions can be found here:
http://analysis.avira.com/samples/details.php?uniqueid=qscRAdpryBESBRjnkwdwtEUpRBEhXQSM

Please note: If you have specific questions please address them to [email]support@avira.com[/email]
Kind regards
Avira Virus Lab

———————————————
Avira Operations GmbH & Co. KG
Kaplaneiweg 1, 88069 Tettnang, Germany
Phone: +49 (0) 7542-500 0
Fax: +49 (0) 7542-500 3000
Internet: http://www.avira.com

CEO: Tjark Auerbach
Headquarter: Tettnang
Commercial register: AG Ulm HRB 630992
———————————————

Wizzup?

2011-12-07 10:11:26

From: Kave
Dear Sir or Madam,

Thank you for your email to Avira's virus lab.
Tracking number: INC00911737.

A listing of files alongside their results can be found below:
File ID Filename Size (Byte) Result
26433951 Simba.exe 3.92 MB FALSE POSITIVE


Please find a detailed report concerning each individual sample below:
Filename Result
Simba.exe FALSE POSITIVE

The file 'Simba.exe' has been determined to be 'FALSE POSITIVE'.In particular this means that this file is not malicious but a false alarm.Detection will be removed from our virus definition file (VDF) with one of the next updates.

Alternatively you can see the analysis result here:
http://analysis.avira.com/samples/details.php?uniqueid=7fcgc0sQ207x7xhhTW0k08YRpTFwsNSH&incidentid=911737

An overview of all your submissions can be found here:
http://analysis.avira.com/samples/details.php?uniqueid=7fcgc0sQ207x7xhhTW0k08YRpTFwsNSH


That's pretty neat. Good work everyone.