KVR Audio

heyheycnv · Post by **heyheycnv** » Wed Jun 29, 2022 12:52 pm

According to Defender this little install included malware, Bladabindi!ml.

pough · Post by **pough** » Wed Jun 29, 2022 3:44 pm

heyheycnv wrote: Wed Jun 29, 2022 12:52 pm According to Defender this little install included malware, Bladabindi!ml.

Defender's not finding anything in the installer I downloaded (version 1.0.0). Where did you get the installer from?

ramseysounds · Post by **ramseysounds** » Wed Jun 29, 2022 4:21 pm

My version was clean. Downloaded directly from the developers site.

heyheycnv · Post by **heyheycnv** » Wed Jun 29, 2022 4:39 pm

I downloaded it from the email link sent to me -

Thank you for your subscription. Click the link below to download the item:
https://integraudio.com/?opd=
Thank you
Integraudio & Sixth Sample

and Defender

Backdoor:Win32/Bladabindi!ml
Affected items:
containerfile: Integraudio\Deelay by Integraudio & Sixth Sample (1).rar
file: Integraudio\Deelay by Integraudio & Sixth Sample (1).rar->Deelay-1.0.0-Installer-32bit.exe
file: Integraudio\Deelay by Integraudio & Sixth Sample (1)\Deelay-1.0.0-Installer-32bit.exe

pough · Post by **pough** » Wed Jun 29, 2022 7:11 pm

Ah. I didn't download the 32 bit version originally but now that I have, Defender jumped in and deleted it right away. Different virus, though: Trojan:Win32/Spursint.F!cl

I'm sending a message to the developer.

Teksonik · Post by **Teksonik** » Wed Jun 29, 2022 7:29 pm

I ran the zip file that I downloaded on June 17th through Virus Total and it scored 100% clean. I scanned it with Bitdefender on this system and again it is clean.

On my studio system Microsoft Defender did not trigger any action.

Perhaps this is with newer versions of the download.

You can run the installer that's triggering the Defender warnings through Virus Total and see how it scores.

https://www.virustotal.com/gui/home/upload

I ran the 32 bit installer through Virus Total and it did score 2 but these are not security programs I recognize. All the big names including Microsoft Defender show it as clean.

Same results for the 64 bit installer. At this time it points more to be being a false positive.

VTotal 062922.png

heyheycnv · Post by **heyheycnv** » Wed Jun 29, 2022 7:58 pm

I only got this warning running a full scan (20 some hours) on W10. Doing the quick scan didn't bring up anything.

Teksonik · Post by **Teksonik** » Thu Jun 30, 2022 2:28 am

Are you saying Defender didn't catch it during installation but detects it after a full scan?

When did you download the Deelay installer?

heyheycnv wrote: Wed Jun 29, 2022 4:39 pm containerfile: Integraudio\Deelay by Integraudio & Sixth Sample (1).rar

The file I downloaded was a .zip file not a .rar file.

Aloysius · Post by **Aloysius** » Thu Jun 30, 2022 3:00 am

Trojan:Script/Ulthar.A!ml

Oh well.

Put straight into quarantine by virus protection software on download.
Windows 10.

Reported to developer.

Teksonik · Post by **Teksonik** » Thu Jun 30, 2022 1:49 pm

Aloysius wrote: Thu Jun 30, 2022 3:00 am Trojan:Script/Ulthar.A!ml
Oh well.
Put straight into quarantine by virus protection software on download. Windows 10.

Which virus protection software do you use?

The thing that interests me is the fact that all the reports are different. Bladabindi!ml, then Trojan:Win32/Spursint.F!cl and now Trojan:Script/Ulthar.A!ml

To me if all the reports were the same it would be more of an indication that it's not a false positive. Since all the reports are different it seems more like the heuristics are simply seeing something odd and acting out of an abundance of caution.

When did you guys download the file? It's possible a corrupted file was injected at some point after the original release. He's just using sendspace so no telling how secure that is.

Neither Bitdefender Total Security or Windows Defender flagged the installation here using the file I downloaded on the 17th of this month. A full deep scan of the C: drive on this system found nothing.

Aloysius · Post by **Aloysius** » Thu Jun 30, 2022 1:57 pm

Windows Security.

Developer has been notified.

He / She / They / Them / Other will probably investigate.

El°HYM · Post by **El°HYM** » Thu Jun 30, 2022 2:07 pm

Teksonik · Post by **Teksonik** » Thu Jun 30, 2022 2:15 pm

Aloysius wrote: Thu Jun 30, 2022 1:57 pm Windows Security.
Developer has been notified.
He / She / They / Them / Other will probably investigate.

The developer was notified yesterday as well. When did you download the file? That is important information for the developer and the rest of us to know.

Ok at this point I can only recommend that no one download or install Deelay until we hear from the developer.

El°HYM · Post by **El°HYM** » Thu Jun 30, 2022 2:24 pm

The developer might just answer with the same Info, as on his Page:

https://integraudio.com/deelay-review

This is not the same Site, as in this original Post. Maybe something to investigate; yet should be both sent out via Mail, for Downloading.

pough · Post by **pough** » Thu Jun 30, 2022 3:43 pm

I got a response from the developer. It's a false positive. He's trying to work with Microsoft to resolve the issue.

It's just the 32-bit installer, right? As far as I know, the 64-bit installer has no problem.

Sixth Sample Deelay (Tape/Pitch/Ducking/Reverse/Diffuse/Reverb) FREE WIN/MAC