F/P:   Zemana Anti-Logger Leak Test Program

ky331 · 2015-04-04T20:56:36.000Z

Zemana Anti-Logger Testing program (Spy Simulation Leak Test), version 1.7.2.234.

Never had an issue with avast objecting to this previously… now it’s coming up as Win32:Malware-Gen under avast definitions 15-04-04-01.

While I believe this is a F/P, I will acknowledge that several other a-v programs are now detecting it as well, typically under a generic or PUP category, likely because of its relation to the (Anti-)Keylogger.

https://www.virustotal.com/en/file/f2dfc05a5cde613eee3b060b3a5aa208d3cfb4555991e5cf5d6b30d725665abd/analysis/1428180146/

I will be submitting this file from my virus vault for your consideration.

Pondus · 2015-04-04T21:37:17.000Z

First submission 2013-02-24 01:22:40 UTC ( 2 years, 1 month ago )

Copyright© Zemana Ltd. All rights reserved. Publisher Zemana Ltd. Product Zemana Spy Simulation Leak Test Original name KeyLogger.exe File version 1.7.2.234 Description Zemana Spy Simulation Leak Test Comments Zemana Spy Simulation Leak Test

ky331 · 2015-04-04T22:03:27.000Z

Pondus,

I’m not sure what to make of your reply?

Are you saying that I submitted this file to avast 2+ years ago? Or that someone (else) had already questioned this file back then??

Suffice it to say that I’ve run complete scans on my systems over the past year or two, withOUT avast questioning this file. In addition, I understand that Win32:Malware-Gen (as well as Evo-Gen) are more prone to F/P’s than non-heuristic methods. So I have to ask again, has avast changed its classification of this file, now deeming it (generic) malware — perhaps a PUP — or is this new finding a F/P [which was not being detected in my previous scans]?

polonus · 2015-04-04T22:15:44.000Z

Hi ky331,

Think the detection is a PUP detection by 11 AV programs. A PUP is no virus but a potentially unwanted program (could be because of added bundled software/adware/nagware/junkware. If you have intentionally downloaded the program yourself and are aware of what it does, you can ignore that detection. What Pondus means that the first VT results to denote it as PUP were detected that time ago. Re: http://www.herdprotect.com/aklt.exe-07a478caafb1079b0f8110fc6532af78a6bab132.aspx
Also consider: http://www.freefixer.com/library/file/AKLT.exe-159773/ (where only 19% of users decided to no longer have it installed).

polonus

DavidR · 2015-04-04T22:20:44.000Z

ky331 post:3:

Pondus,

I’m not sure what to make of your reply?

Are you saying that I submitted this file to avast 2+ years ago? Or that someone (else) had already questioned this file back then??

Suffice it to say that I’ve run complete scans on my systems over the past year or two, withOUT avast questioning this file. In addition, I understand that Win32:Malware-Gen (as well as Evo-Gen) are more prone to F/P’s than non-heuristic methods. So I have to ask again, has avast changed its classification of this file, now deeming it (generic) malware — perhaps a PUP — or is this new finding a F/P [which was not being detected in my previous scans]?

No, he isn’t.

If you check the Additional Information tab on the VT results page, you get to know when it was first submitted and that the MD5 file hash ( 27c1776f47c7e25e38b55ab3e83b32b0 ) is the same.

It just means that it has been around for some considerable time and what you submitted is the same - as it has the same unique MD5 file hash.

A detection on this would be akin to an eicar virus test.

polonus · 2015-04-04T22:28:47.000Z

Hi ky331 and DavidR,

These kind of tools are being detected because they can bypass the Windows Activation Technologies in Windows 7, but they are not known to be extremely dangerous programs. Therefore the PUP detection. Microsoft security software detects and removes this threat.

polonus

ky331 · 2015-04-04T23:49:12.000Z

I could understand the “PUP” classification, per your explanation(s)… but why is it being detected as “Malware-Gen”?

Pondus · 2015-04-05T00:08:12.000Z

Avast does not have a specific signature for it … but the program behave similar to known malware

Generic detection https://www.virusbtn.com/resources/glossary/generic_detection.xml

Announcements