Virus alert: vmdetect.exe

[jellow]

After updating to the latest version my Virusscanner (F-Secure) keeps complaining about an dropper in vmdetect.exe

After scanning with virustotal I assume a false positive, but you should find out why some scanners are complaing and code around it
http://www.virustotal.com/file-scan/rep ... 1313507207

[Bogdan]

Hi,

Thanks for bringing this to our attention. We have already submitted our new file to the major anvitirus providers and it should be very soon eliminated from their lists of potential threats.
We shall continue scanning it on VirusTotal submitted it to other security solution providers if other detections appear.

In the mean time I can assure you this is just a false positive detection and you can add the file to your trusted files list, for the antivirus.

Regards,
Bogdan

[Masterpiece]

I am unable to add the file to a "safe list" and the file gets quarantined. The product seems to run ok except it reinstalls evertime I kick it off. What i want to know is what the vmdetect.exe does and having it missing will it be effecting my installers?

[Bogdan]

Hi,

The false detection should have been removed by now by the guys from F-Secure, I shall try contacting them again.

What i want to know is what the vmdetect.exe does and having it missing will it be effecting my installers?

This file is used for a new feature in our application, i.e. a new predefined launch condition used to detect if the package is installed on a virtual machine or not.
So if you are not enabling this launch condition the EXE will never be used by Advanced Installer in your packages.

Regards,
Bogdan

[Masterpiece]

I'm using McAfee VirusScan and Virgin Media Secure and we are still getting the notification even after todays latest updates. Do you have any idea when it will be resolved?

[mihai.petcu]

Hi,

We have already sent multiple reminders to McAfee regarding this but to no avail it seems. Please keep us posted and if the next upgrade doesn't clear the notification, we will contact them again.

All the best,
Mihai

[Bogdan]

Hi,

Since we got no reply from F-Secure team we made another submission, this time it seems we had more luck. Here is their answer:

Hello,

Thank you for your submission.

The file you submitted is indeed clean. A database update will be released to resolve this issue.

For the meantime, you may exclude this file from Real-time Scanning. Instructions for exclusions can be found here:

Internet Security 2008 and 2009:
http://www.f-secure.com/en/web/home_glo ... /15128/p/1

Internet Security 2010, Internet Security 2011, Client Security 9:
http://www.f-secure.com/en/web/home_glo ... k/7423/p/1

For the latest database updates please visit this page:
http://www.f-secure.com/en_EMEA/securit ... databases/

We apologize for any inconveniences that this may have brought you. Should you have further questions, please do not hesitate to email us again.

Best regards,
--------
F-Secure Security Labs http://www.f-secure.com/weblog/
F-Secure Corporation http://www.f-secure.com/

We are still working on the McAfee detection, but it should be removed very soon also.

Regards,
Bogdan