TAL Malware?

[Dedward]

AUTO-ADMIN: Non-MP3, WAV, OGG, SoundCloud, YouTube, Vimeo, Twitter and Facebook links in this post have been protected automatically. Once the member reaches 5 posts the links will function as normal.

Yesterday, VirusTotal warned of

Trojan-Dropper.Win32.Fearless

in
https://tal-software.com/downloads/plug ... ponent.zip (https://tal-software.com/downloads/plugins/TAL-Reverb-3.component.zip) and
https://tal-software.com/downloads/plug ... ponent.zip (https://tal-software.com/downloads/plugins/TAL-Reverb-3-x64.component.zip).

I'm not a computer person, so I'd welcome informed comment.

[chk071]

VirusTotal scans the files with multiple virus scanners. How many of those actually flagged the file as malicious? And why does the Mac AU contain a Windows virus? A bit puzzling this. 99,9 % false alarm, and, considering it's from the original TAL website, i'd say 100 % false alarm.

[Dedward]

AUTO-ADMIN: Non-MP3, WAV, OGG, SoundCloud, YouTube, Vimeo, Twitter and Facebook links in this post have been protected automatically. Once the member reaches 5 posts the links will function as normal.

VirusTotal scans the files with multiple virus scanners. How many of those actually flagged the file as malicious?

At time of scanning, the Reverb-3 component scored 4 / 56 (https://www.virustotal.com/en/file/f455d8253df385d268f337ce922e02daf1d74336854871994b2473bd3515bf67/analysis/1492587516/)
and the Reverb-3-x64 component scored 5 / 54 (https://www.virustotal.com/en/file/d55320abe604c9c77ed97a71f25ebb3fac40fa20be57ab730be8104565c2ede8/analysis/1492587494/)

[BlackWinny]

To reply your question, a few minutes ago I have downloaded again this full page (using DownThemAll for Firefox) with my professional edition of AVAST (this edition, that I use for 3 computers and registers every three years).


Result: No problem. My professional edition of Avast hasn't blocked any file:




Then I have checked again by a full manual scan on the target directory. My professional AVAST replied this:




Conclusion: No threat. Even inside the zip files (my AVAST scans also inside the compressed files, of any compression format for PC, OSX and Linux... normal, hey, it is an edition with features even for servers!).

Conclusion of the conclusion: your antivirus arise false alerts. That's now obvious.

[BlackWinny]

That being now said... You're welcome at KVR !

[chk071]

I can only repeat myself, if it really was true what some antivirus' on VirusTotal are detecting there (and i doubt that), the Trojan reported would be actually useless on a Mac machine, because it's a Windows virus. And why would someone pack a Windows virus in a Mac AU package?

[BlackWinny]

I can only repeat myself, if it really was true what some antivirus' on VirusTotal are detecting there (and i doubt that), the Trojan reported would be actually useless on a Mac machine, because it's a Windows virus. And why would someone pack a Windows virus in a Mac AU package?

You're right.

It's simply if in a future the file would be shared with others. But you're totally right.

[Dedward]

AUTO-ADMIN: Non-MP3, WAV, OGG, SoundCloud, YouTube, Vimeo, Twitter and Facebook links in this post have been protected automatically. Once the member reaches 5 posts the links will function as normal.

Conclusion of the conclusion: your antivirus arise false alerts. That's now obvious. That being now said... You're welcome at KVR !

Thanks for checking; thanks for the welcome; and thanks to you both for responding.

Perhaps the TAL webperson might wish to add a note of reassurance to that page, given that the number of false positives has now risen to 7 / 58 (https://www.virustotal.com/en/file/d55320abe604c9c77ed97a71f25ebb3fac40fa20be57ab730be8104565c2ede8/analysis/1492807788/).

[chk071]

8 now even... really weird. Even serious stuff like Kaspersky and Symantec reporting a virus signature. Patrick should really look into that.

[BlackWinny]

Conclusion of the conclusion: your antivirus arise false alerts. That's now obvious. That being now said... You're welcome at KVR !

Thanks for checking; thanks for the welcome; and thanks to you both for responding.

Perhaps the TAL webperson might wish to add a note of reassurance to that page, given that the number of false positives has now risen to 7 / 58.

Perhaps, yes... But that kind of false positives is at 99.99% the result of issues at the client side, not at the server side (you can observe that I don't forget the 00.01% where it is really at the server side).
And the normal behavior in that kind of weird occurrences is precisely to do what you did: ask among the members of a community if they can confirm the integrity of the files on the server. It is what you did, and it is the best way, man.

Otherwise... ALL the developers should have to add a message (in bold, red, etc.) in ALL their pages simply to affirm that their files are checked seriously before to put them online. Generally it is already done in a 'About" page or a "Terms of service" page or in any form whatsoever usually linked somewhere in the page feet or in the menu (depending on the case... and on the graphic designer of the website. But it is useless in fact (except in these juridically important pages aforementioned), because even in the situation of adding a message in bold, red, etc. on EACH product page of EACH website (which would lead to the generalization of this message throughout the thousands of websites offering something to download) there would always be some persons to keep on affirming through thick and thin that at their side their antivirus is absolutely irreproachable and that the problem is necessarily on the server side.

Other consequence of a generalization of that kind of message: it would finally lead quite quickly to a lack of reading of that message by the visitors. With the consequence... that we get back to the starting point.


So no... the best is actually to do exactly what you did: ask other persons (the best place being in a community of users of that kind of files, so... for VST plugins here at KVR or at Gearlutz or Audiofanzine...) if there is or is not something exceptionally strange with the mentioned files.

[DuX]

It's so great that you have a professional version of Avast because the freeware one wouldn't cut it.

I love people who have to use AVs and have at least 10 unnecessary icons in the systray so much... It makes me wanna cry.

AVs are the greatest thing since they invented the wheel, bread and wine. Its inventiveness is only comparable to burning the witches.