Kryptik-PFA [Trj]

Avast Business Avast Endpoint Protection
1

Users all over my network are getting infection alerts for Kryptik-PFA [Trj] after the latest 150506-3 update. I think it’s a massive false-positive reaction. Can anyone confirm and fix on the next update?

2

Same here.

3

SAME HERE!

4

We’re seeing a major uptick in notifications for this virus too.

5

What OS’s? So far I haven’t heard from anyone else. So far its just me with Windows 8.1

6

It has started blocking chrome.exe district-wide on almost 22,000 machines! I’m dying over here!!!

7

so far its only happening to our windows 8.1 PC’s as well.

8

Can you change your group settings to ‘no action’ for now?

9

Our systems are 64-bit Windows 7 Pro.

10

We’re seeing this in our school district, too. We’re getting hits on 32-bit and 64-bit Windows 7 Professional.

We’re getting false positives on “C:\windows\system32\MBWrp32.dll” mainly. I sent that file off to VirusTotal and got this back:

https://www.virustotal.com/en/file/8f9234b7efd9e06430c79615a3491f59e105622ad439db3042364ebbb0554e43/analysis/

We gotten a couple hits on “C:\Program Files\Google\Chrome\Application\39.0.2171.95\libglesv2.dll”, too.

It sure looks like a false positive. I threw on a couple of exclusions to try and stem the tide.

Anybody know if there’s an API that I can use to connect to the “Virus Chest” on a hundred PCs to restore this file, or am I better off just copying it with a script?

Edit:

It looks like this is going to be a chance to exercise an “Auxiliary Task” to restore previously-detected files from the “Virus Chest” that are no longer detected once Avast updates the definitions. >sigh<

11

Same here. Different files, machines all over the network. Virustotal shows the files are clean, even by Avast.

12

Do you have a ‘How to’ on that? :slight_smile:

13

Same here

14

Same here :frowning:

15

You guys/gals seeing this on 32-bit and 64-bit or just 32-bit?

16

64 bit

17

Please post how you do this if it works for you. I wonder if there is a way to rollback the definitions for all of the clients from the console to prevent the issue from spreading? Does anybody have a recovery plan for a situation like this you would like to share?

This is happening on most of our systems which are a mix of Win 7 and 8.1 64-bit, but luckily it is not flagging any important files that are affecting our users.

18

??? ???Same Here :cry:

19

We’re seeing this on 32-bit and 64-bit, Windows 7 and Windows 8 (and 8.1). It’s killing DLL files associated with Office 2010 and Office 2013 - we can’t use Excel, Outlook, Word, etc.

20

same here. win 8.1 64bit.