Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 5 replies
  • Subscribers 1 subscriber
  • Views 2666 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

False Positive dota.exe Troj/Ransom-RT

PeterEnis

Hi.

It seems there is a problem with the recently updated Troj/Ransom-RT detection.

When i tried to launch Dota2 today Sophos claimed that dota.exe  and several other files in the game folder are infected with Troj/Ransom-RT and deleted several files. When i tried to redownload the deleted files via steam they got deleted again right away.

Since Steam downloads these files directly from the Steam servers and the Detection files for the Virus in question got updated a few hours ago i assume there is a false positive.

I added the output from Sophos regarding the files in the following spoiler tag.

Really annoying since im not able to Play Dota 2 right now.

20130815 002351    Die Erkennungsdatenversion 4.91G (Detection Engine 3.45.0) wird verwendet. Diese Version kann 5363789 Objekte erkennen.
20130815 002351    Benutzer (NT-AUTORITÄT\SYSTEM) hat den On-Access-Scan auf diesem Computer gestartet.
20130815 002351    Treibereinstellungen für On-Access-Scans:
    Filter beim Lesen: Wahr
    Filter beim Schreiben: Wahr
    Filter beim Umbenennen: Wahr
    Bootsektorzugriff genehmigen: Falsch
    Alle Dateien prüfen: Falsch.
20130815 013727    Datei "C:\Dota2\dota 2 beta\dota.exe" gehört zu Virus/Spyware 'Troj/Ransom-RT'.
20130815 013727    On-Access-Scanner hat den Zugriff auf den Speicherort "C:\Dota2\dota 2 beta\dota.exe" für folgenden Benutzer verweigert: ***************
20130815 013734    Datei "C:\Dota2\dota 2 beta\dota.exe" gehört zu Virus/Spyware 'Troj/Ransom-RT'.
20130815 013734    Registrierungseintrag "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\{145C4EB1-10CE-49D3-BE53-63E582C576F9}" gehört zu Virus/Spyware 'Troj/Ransom-RT'.
20130815 013734    Registrierungseintrag "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\{713F7EB8-A3EA-4490-B1FF-DFA6876F288A}" gehört zu Virus/Spyware 'Troj/Ransom-RT'.
20130815 013734    Registrierungseintrag "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Start" gehört zu Virus/Spyware 'Troj/Ransom-RT'.
20130815 013734    Registrierungseintrag "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall" gehört zu Virus/Spyware 'Troj/Ransom-RT'.
20130815 013734    Registrierungsschlüssel "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts" gehört zu Virus/Spyware 'Troj/Ransom-RT'.
20130815 013734    Registrierungseintrag "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall" gehört zu Virus/Spyware 'Troj/Ransom-RT'.
20130815 013734    Registrierungsschlüssel "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts" gehört zu Virus/Spyware 'Troj/Ransom-RT'.
20130815 013734    Registrierungseintrag "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall" gehört zu Virus/Spyware 'Troj/Ransom-RT'.
20130815 013734    Registrierungsschlüssel "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\GloballyOpenPorts" gehört zu Virus/Spyware 'Troj/Ransom-RT'.
20130815 013734    Registrierungseintrag "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\{145C4EB1-10CE-49D3-BE53-63E582C576F9}" wurde bereinigt.
20130815 013734    Registrierungseintrag "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\{713F7EB8-A3EA-4490-B1FF-DFA6876F288A}" wurde bereinigt.
20130815 013735    Datei "C:\Dota2\dota 2 beta\dota.exe" wurde bereinigt.
20130815 013735    Registrierungseintrag "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Start" wurde bereinigt.
20130815 013735    Registrierungseintrag "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall" wurde bereinigt.
20130815 013735    Registrierungsschlüssel "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts" wurde bereinigt.
20130815 013735    Registrierungseintrag "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall" wurde bereinigt.
20130815 013735    Registrierungsschlüssel "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts" wurde bereinigt.
20130815 013735    Registrierungseintrag "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall" wurde bereinigt.
20130815 013735    Registrierungsschlüssel "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\GloballyOpenPorts" wurde bereinigt.
20130815 013735    Virus/Spyware 'Troj/Ransom-RT' entfernt.
20130815 020122    Datei "C:\Dota2\dota 2 beta\bin\SHADERAPIEMPTY.DLL" gehört zu Virus/Spyware 'Troj/Ransom-RT'.
20130815 020122    On-Access-Scanner hat den Zugriff auf den Speicherort "C:\Dota2\dota 2 beta\bin\SHADERAPIEMPTY.DLL" für folgenden Benutzer verweigert: ***********
20130815 020123    Datei "C:\Dota2\dota 2 beta\bin\VAUDIO_MILES.DLL" gehört zu Virus/Spyware 'Troj/Ransom-RT'.
20130815 020123    On-Access-Scanner hat den Zugriff auf den Speicherort "C:\Dota2\dota 2 beta\bin\VAUDIO_MILES.DLL" für folgenden Benutzer verweigert: ************
20130815 020129    Datei "C:\Dota2\dota 2 beta\bin\SHADERAPIEMPTY.DLL" gehört zu Virus/Spyware 'Troj/Ransom-RT'.
20130815 020131    Datei "C:\Dota2\dota 2 beta\bin\VAUDIO_MILES.DLL" gehört zu Virus/Spyware 'Troj/Ransom-RT'.
20130815 020132    Datei "C:\Dota2\dota 2 beta\bin\SHADERAPIEMPTY.DLL" wurde bereinigt.
20130815 020134    Datei "C:\Dota2\dota 2 beta\bin\VAUDIO_MILES.DLL" wurde bereinigt.
20130815 020134    Virus/Spyware 'Troj/Ransom-RT' entfernt.
20130815 020149    Datei "D:\Steam\steamapps\downloading\570\bin\shaderapiempty.dll" gehört zu Virus/Spyware 'Troj/Ransom-RT'.
20130815 020149    Datei "D:\Steam\steamapps\downloading\570\bin\vaudio_miles.dll" gehört zu Virus/Spyware 'Troj/Ransom-RT'.
20130815 020150    Datei "D:\Steam\steamapps\downloading\570\dota.exe" gehört zu Virus/Spyware 'Troj/Ransom-RT'.
20130815 020156    Datei "D:\Steam\steamapps\downloading\570\bin\shaderapiempty.dll" gehört zu Virus/Spyware 'Troj/Ransom-RT'.
20130815 020158    Datei "D:\Steam\steamapps\downloading\570\bin\vaudio_miles.dll" gehört zu Virus/Spyware 'Troj/Ransom-RT'.
20130815 020200    Datei "D:\Steam\steamapps\downloading\570\dota.exe" gehört zu Virus/Spyware 'Troj/Ransom-RT'.
20130815 020201    Datei "D:\Steam\steamapps\downloading\570\bin\shaderapiempty.dll" wurde bereinigt.
20130815 020203    Datei "D:\Steam\steamapps\downloading\570\bin\vaudio_miles.dll" wurde bereinigt.
20130815 020204    Datei "D:\Steam\steamapps\downloading\570\dota.exe" wurde bereinigt.
20130815 020204    Virus/Spyware 'Troj/Ransom-RT' entfernt.
:42622


This thread was automatically locked due to age.
Parents
  • 0

    Hello MikeMiller007,

    I'm not Sophos :smileyhappy:, I'm just trying to convey some background. While your reaction is understandable, the whole process is not as simple as it looks on the first glance. Allow me to explain some details.

    Sophos has removed those files and they no longer exist

    Admittedly this is can be the worst case - false positives happen, it's definitely not feasible to absolutely avoid them (disputably it's theoretically possible for "existing" files). Quite unpleasant if it happens with "old" files which are no longer available - a reminder that you should regularly back up "important" stuff (especially as there are also other ways to lose them). 

    a lab environment so you could reproduce these results

    This is only partially true. Of course these lab environments exist and the results can be reproduced given the respective files can be obtained by the vendor and the environment is sufficiently similar. Obtaining the files is not so simple - for example, even with free applications you often need to sign up and what you get might also depend on your OS (version) and depend on or require other software. If an installation process is involved you can't just download on an arbitrary platform and scan. But more important - there's a twist (especially in conjunction with malware): Files downloaded by different clients, in different locations and from different servers (which is usually the case for popular files as they are hosted on content distribution networks) might not be the same. 

    [the logs hows] what those files were

    This information is (see above) not sufficient to identify the actual content.

    software patches [...] if i wanted to do your job

    Technically detection identities are (at least part) software as they are instructions for a virtual machine, the detection engine (for the same reason they are not simple strings which are looked up). You might want to read chapter 2 in this article to get an idea what the "test part" (other parts are analyzing threats, writing the software - engine, integration with the OS, UI, updates and management -, providing the infrastructure and so on) of their job encompasses. Guess any vendor would be more than happy if in their job it would be even remotely possible to assure 100% correct results. There are literally millions of applications out there, you can't make sure you have all the latest versions, let alone that you can test and roll out your changes before users can download them. You could argue that in this case the files were already "known" - but it's all but impossible to test against all applications.

    try to capture the file

    Thanks for taking the effort - I hope I was able to explain why you "have to do their job" :smileywink:

    Christian

    :42754
Reply
  • 0

    Hello MikeMiller007,

    I'm not Sophos :smileyhappy:, I'm just trying to convey some background. While your reaction is understandable, the whole process is not as simple as it looks on the first glance. Allow me to explain some details.

    Sophos has removed those files and they no longer exist

    Admittedly this is can be the worst case - false positives happen, it's definitely not feasible to absolutely avoid them (disputably it's theoretically possible for "existing" files). Quite unpleasant if it happens with "old" files which are no longer available - a reminder that you should regularly back up "important" stuff (especially as there are also other ways to lose them). 

    a lab environment so you could reproduce these results

    This is only partially true. Of course these lab environments exist and the results can be reproduced given the respective files can be obtained by the vendor and the environment is sufficiently similar. Obtaining the files is not so simple - for example, even with free applications you often need to sign up and what you get might also depend on your OS (version) and depend on or require other software. If an installation process is involved you can't just download on an arbitrary platform and scan. But more important - there's a twist (especially in conjunction with malware): Files downloaded by different clients, in different locations and from different servers (which is usually the case for popular files as they are hosted on content distribution networks) might not be the same. 

    [the logs hows] what those files were

    This information is (see above) not sufficient to identify the actual content.

    software patches [...] if i wanted to do your job

    Technically detection identities are (at least part) software as they are instructions for a virtual machine, the detection engine (for the same reason they are not simple strings which are looked up). You might want to read chapter 2 in this article to get an idea what the "test part" (other parts are analyzing threats, writing the software - engine, integration with the OS, UI, updates and management -, providing the infrastructure and so on) of their job encompasses. Guess any vendor would be more than happy if in their job it would be even remotely possible to assure 100% correct results. There are literally millions of applications out there, you can't make sure you have all the latest versions, let alone that you can test and roll out your changes before users can download them. You could argue that in this case the files were already "known" - but it's all but impossible to test against all applications.

    try to capture the file

    Thanks for taking the effort - I hope I was able to explain why you "have to do their job" :smileywink:

    Christian

    :42754
Children
No Data