Converterxtohd Being Detected as a Virus

[jmanwf]

Hi guys think it is a false positive by windows 10 64 bit security essentials is detecting this program as a trojin

[jmanwf]

Just ran another scan it seems to be okay now will keep you guys informed

[Mr. Furious]

Yeah, I'm seeing the same thing. Since installing CXHD 2 and CXDVD 6 it keeps detecting the following:

!#JenxcusCustomBase64Deobfuscator
HackTool:Win32/BrowserPassview
Trojan:Win32/Varpes.J!plock

It basically tries over and over to clean or remove them and always reports that it was successful, but goes right back to reporting them. A full MBAM scan comes back clean, but it's still a little unnerving.

[jmanwf]

Yes this is the one i get as well seems to be a vso problem not sure if it is a faulse positive.

Trojan:Win32/Varpes.J!plock

[JJ]

Just to be sure, I checked all VSO products installed in my system with Panda AV.
No problems, no trojans.

[Mr. Furious]

Just to be sure, I checked all VSO products installed in my system with Panda AV.
No problems, no trojans.

That's the thing - a full system scan (I used MBAM) reveals absolutely nothing. Windows Defender, however, keeps reporting that there is a potential threat. It is most likely a false positive, but it's annoying and new with CXDVD 6 and CXHD 2 (the second item in the second screenshot shows the CXHD path).

The first screenshot shows detected items, and there is no path listed for those. However, they showed up at the same time as the others, so the correlation is clear.

[SomeoneElse]

Whether it is or isn't a legit virus, obviously it needs to be remedied.

[Mr. Furious]

Any movement on this one?

[Mr. Furious]

So this is interesting. My hard drive died and I re-installed Windows. I re-installed CXHD and CXDVD, and they're not being picked up as a virus anymore. I installed CXHD 2.0.0.27 and CXDVD 6.0.0.27.

[jmanwf]

Not solved this has come back again. Whats going on with this is it a false positive. Uploaded screenshot as proof

[JJ]

This seems to be a problem with Microsoft software.
They have changed something and it is causing this.

I switched from Defender to Panda free some time ago since defender was doing really bad in tests, and have been completely happy.

[Mr. Furious]

Not solved this has come back again. Whats going on with this is it a false positive. Uploaded screenshot as proof

Try completely removing CXHD and reinstalling. Before you reinstall, make sure that file and the registry keys are gone.

I scanned the file manually with Windows Defender after my aforementioned system rebuild and it comes back clean.

[JJ]

Not solved this has come back again. Whats going on with this is it a false positive. Uploaded screenshot as proof

Try completely removing CXHD and reinstalling. Before you reinstall, make sure that file and the registry keys are gone.

I scanned the file manually with Windows Defender after my aforementioned system rebuild and it comes back clean.

Then it might be that there is/was something in your system that infected uninstall files.

[Mr. Furious]

Then it might be that there is/was something in your system that infected uninstall files.

And it only infected VSO's uninstall files? That would be kind of an oddly specific virus.

[JJ]

No, most likely it would have infected more but it was caught.
If those files are ok again after reinstall then they had been changed after original installation.
I get no warnings with Panda from originals or installed ones.

[Mr. Furious]

No, most likely it would have infected more but it was caught.
If those files are ok again after reinstall then they had been changed after original installation.
I get no warnings with Panda from originals or installed ones.

I didn't get any with any other virus scanner pre-rebuild either.

EDIT: My guess here is that there was something in an earlier version of the uninstaller that Defender incorrectly tabbed as a virus. The CX* installer does not flag that file to be replaced when doing an upgrade install, so it sits there even after upgrading the application. However, when installed cleanly it has to write the (probably very slightly) updated uninstaller, so everything is cool. I can see not flagging the uninstaller as a file to be replaced during an upgrade install.