KVR Audio

Caine123 · Post by **Caine123** » Fri Sep 15, 2023 11:12 am

strange kaspersky found again this file as trojan banker - same as before my recovery

i checked it via VIRUSTOTAL
https://www.virustotal.com/gui/file/e3b ... /detection

false positive?

i deleted it any way and will re-download my files from slate

BertKoor · Post by **BertKoor** » Fri Sep 15, 2023 12:43 pm

You definitely should report this to Kaspersky. If it is found in other files, then attach those as well.
Would be interesting to know whether this only affects Slate Digital products.
If yes, then definitely report it also to their tech support.

"HEUR" means Heuristics: the scanner analyses the executable for possible malicious actions. Some copy protection methods get flagged as doing suspicious things.

If this file is not an executable but merely a resource (graphics & other data) then it is a unfortunate misinterpretation by the scanner. It cannot know what is what, it just scans everything. Random (especially compressed) data may have similarities with code.

I never heard of the .epl file extension. I suppose only Slate Digital knows what it is.

Caine123 · Post by **Caine123** » Mon Sep 18, 2023 4:09 pm

so this is strange.
i finally booted everything back up after i recovered my about 2 months old c:\ partition.

checkout what happened after some hours.

again the same files, i uploaded these to Virustotal this time, oh i also checked my recovered hard drive before booting up with 3 live cds, Avast, Avira and Eset and nothing found.
https://www.virustotal.com/gui/file/55f ... 83983b6780

https://www.virustotal.com/gui/file/55f ... 83983b6780

https://www.virustotal.com/gui/file/75c ... beddc29355

https://www.virustotal.com/gui/file/55f ... 83983b6780

https://www.virustotal.com/gui/file/66a ... ?nocache=1

https://www.virustotal.com/gui/file/55f ... 83983b6780

so nearly all say nothing is infected and just 2 vendors sometimes say malicious malware.

does it seem to be false positive by kaspersky all of a sudden about a week now?

EDIT
i just downloaded INTENSITY from Zynaptiq and scanned the ZIPs and suddenly it was deleted as well....

i just wrote zynaptiq support but i think this is false positive so far...

BertKoor · Post by **BertKoor** » Mon Sep 18, 2023 5:09 pm

It is possible that various scanning companies share details and thus identify the same issue, possibly flag the same false positive.

You need to compare checksums of the original uninfected file and your version.
Same checksum => false positive.
Different => infected.

To pull that off perhaps get together with dev of the music software and the virus scanner. Find their tech contact details and use them.

Caine123 · Post by **Caine123** » Mon Sep 18, 2023 5:17 pm

BertKoor wrote: Mon Sep 18, 2023 5:09 pm It is possible that various scanning companies share details and thus identify the same issue, possibly flag the same false positive.

You need to compare checksums of the original uninfected file and your version.
Same checksum => false positive.
Different => infected.

To pull that off perhaps get together with dev of the music software and the virus scanner. Find their tech contact details and use them.

stupid question where can i see the checksum?

BertKoor · Post by **BertKoor** » Mon Sep 18, 2023 5:25 pm

There are too many ways, ask that to Kasperski tech support.

You paid them, they are causing you a headache. So now they need to support you in this mess.

(Possibly this: https://stackoverflow.com/questions/547 ... g#54796341 or something alike)

The Noodlist · Post by **The Noodlist** » Mon Sep 18, 2023 5:45 pm

Caine123 wrote: Mon Sep 18, 2023 5:17 pm stupid question where can i see the checksum?

HashTab https://www.majorgeeks.com/files/details/hashtab.html and
MD5 & SHA Checksum Utility https://www.softpedia.com/get/Security/ ... lity.shtml are 2 that I've used in the past.

Free alternatives https://www.softpedia.com/get/Security/ ... tml#footer

runagate · Post by **runagate** » Mon Sep 18, 2023 6:23 pm

I happened to watch this the other day:

I imagine it has nothing to do with VSTs aside from the fact that infecting a .dll is part of it's persistence

t3toooo · Post by **t3toooo** » Tue Sep 19, 2023 4:13 am

Step 1:

Uninstall Kasperky

Step 2:

Refresh Windows using "keep my files" ( it will delete your apps )

Step 3:

Don't install any Anti-Virus anymore. Use Windows security system instead.

Step 4:

Buy a small, low cost, low energy PC like NUC or similar and use this for online purposes.

Only update your working machine computer and then plug the cable.

Problem solved.

Caine123 · Post by **Caine123** » Tue Sep 19, 2023 6:39 am

t3toooo wrote: Tue Sep 19, 2023 4:13 am Step 1:

Uninstall Kasperky

Step 2:

Refresh Windows using "keep my files" ( it will delete your apps )

Step 3:

Don't install any Anti-Virus anymore. Use Windows security system instead.

Step 4:

Buy a small, low cost, low energy PC like NUC or similar and use this for online purposes.

Only update your working machine computer and then plug the cable.

Problem solved.

thx i thought about it a long time ago too, i would then completely reinstall everything though. would be a lot of work 2-3 days maybe but yeah i think all online plugins need to be activated every 3 months or so atm which are online connected. but im also using adobe cloud and other stuff which is usefol for music stuff so it wouldnt change so much from the current setup.

only thing would be emails and Steam (yeah i play rarely still) and Blizzard launcher would be seperate. this would be another $1000 - $1500 setup though i cannot spend now for a good pc with gpu and cpu etc.

t3toooo · Post by **t3toooo** » Tue Sep 19, 2023 7:57 am

I do not trust Anti-Virus Software in all honestly because I think they are rather targets than protectors. If you want some Online protection I recommend Adguard. Its better to clean install a compromised system even if it takes 2-3 days.
As I said, Windows refreshing should suffice ( after uninstalling the Anti-Virus Software ).
You can try to get support from Kaspersky but don't pay anything.

Caine123 · Post by **Caine123** » Tue Sep 19, 2023 8:21 am

t3toooo wrote: Tue Sep 19, 2023 7:57 am I do not trust Anti-Virus Software in all honestly because I think they are rather targets than protectors. If you want some Online protection I recommend Adguard. Its better to clean install a compromised system even if it takes 2-3 days.
As I said, Windows refreshing should suffice ( after uninstalling the Anti-Virus Software ).
You can try to get support from Kaspersky but don't pay anything.

thx, im pretty sure atm that these are all false positives as these were not recognized before. and suddenly last week. the same 10 files. i also downloaded e.g. from zynaptiq the fresh installer zip for intensity and it was also flagged by Kaspersky as the same HEUR Trojan, i wrote Zynaptiq and they are pretty sure this is false positive but will re-check again. and on virus total it was only flagged by 2 as far as i remember now.

i think/guess the pc is not compromised afaik for now.

t3toooo · Post by **t3toooo** » Tue Sep 19, 2023 8:45 am

Caine123 wrote: Tue Sep 19, 2023 8:21 am
t3toooo wrote: Tue Sep 19, 2023 7:57 am I do not trust Anti-Virus Software in all honestly because I think they are rather targets than protectors. If you want some Online protection I recommend Adguard. Its better to clean install a compromised system even if it takes 2-3 days.
As I said, Windows refreshing should suffice ( after uninstalling the Anti-Virus Software ).
You can try to get support from Kaspersky but don't pay anything.
thx, im pretty sure atm that these are all false positives as these were not recognized before. and suddenly last week. the same 10 files. i also downloaded e.g. from zynaptiq the fresh installer zip for intensity and it was also flagged by Kaspersky as the same HEUR Trojan, i wrote Zynaptiq and they are pretty sure this is false positive but will re-check again. and on virus total it was only flagged by 2 as far as i remember now.

i think/guess the pc is not compromised afaik for now.

That's good news

Caine123 · Post by **Caine123** » Tue Sep 19, 2023 8:52 am

t3toooo wrote: Tue Sep 19, 2023 8:45 am
Caine123 wrote: Tue Sep 19, 2023 8:21 am
t3toooo wrote: Tue Sep 19, 2023 7:57 am I do not trust Anti-Virus Software in all honestly because I think they are rather targets than protectors. If you want some Online protection I recommend Adguard. Its better to clean install a compromised system even if it takes 2-3 days.
As I said, Windows refreshing should suffice ( after uninstalling the Anti-Virus Software ).
You can try to get support from Kaspersky but don't pay anything.
thx, im pretty sure atm that these are all false positives as these were not recognized before. and suddenly last week. the same 10 files. i also downloaded e.g. from zynaptiq the fresh installer zip for intensity and it was also flagged by Kaspersky as the same HEUR Trojan, i wrote Zynaptiq and they are pretty sure this is false positive but will re-check again. and on virus total it was only flagged by 2 as far as i remember now.

i think/guess the pc is not compromised afaik for now.
That's good news

thx still i might in near future switch to a dedicated music pc sparingly being online like you reminded me !

BertKoor · Post by **BertKoor** » Tue Sep 19, 2023 9:07 am

Have you reported it as suspected false positive already?
https://support.kaspersky.com/common/error/other/1870

Trojan-Banker.Win32.Qbot.gen found -> recover system? Win10