Heads up for a virus G.V. Katzy

It might be a good idea to actually research as to where the source of your particular infection is coming from.
 
I've just downloaded a bunch of files from Klanghelm's site including the one you suspected and they are all clean.  A quick internet search shows that you are currently the only person in the whole wide web citing anything from Klanghelm as being an issue. 
 
It's pretty bad form if you go round flagging up some developers site as being the cause of a virus outbreak without specific evidence to back it up.  The poor guy is trying to sell plugins for a living.
 
I'd say you and your 'friend' are both getting it from a common source but it ain't this one.
 
The best advice I can think of before you install ANY download is to image before, so you can restore afterward. 
 
System restore doesn't cut it and there is no such thing as successfully removing a virus from an infected machine yet some folk spend days and weeks trying.
 
Nothing wrong with having a music PC connected to the internet 24/7 btw, many people do these days, a much worse idea is getting viruses on your music PC like you clearly have.
 

Kalle Rantaaho

Also, it worries me that F-Secure did not spot the malware by the download.

That's because it happened after it got on your system.


Ahhhh ...

Kalle Rantaaho

Bub

Kalle Rantaaho

Also, it worries me that F-Secure did not spot the malware by the download.

That's because it happened after it got on your system.

Ahhhh ...

Ehhh...is that a pun or something? What happened after what ???
The protection software automatically scans anything new  that comes in. If I plug in a memory stick, it automatically checks it. Is it possible for a malware to creep into a zip-file? I've thought the malware must be present when the file gets zipped. We're not talking about a virus that attacks actively, AFAIK, but a malware that needs to be launched by opening the file where it hides.  I erased the company name from the original title to avoid unnecessary "discomfort". 

My apologies. I should have put a smiley. That was "Ahhhh ..." as in an "Ah Ha!" Moment where something suddenly becomes clear and makes sense.


If you download a file, and your protection software scans it as it's downloading, or scans it the second it is done downloading before you get a chance to open it, and it does not find anything wrong, then the infection happened after you downloaded the file and it was checked by your protection software.


Somewhere between the time you downloaded the file and when you checked it with your software is when the infection happened. It didn't come that way from their site.


Yes, it's possible for a zip to be infiltrated without evidence of it ever being opened.


These people doing this crap are scary smart, anything is possible.

Is it possible that a malware goes inside a zip-file after I've downloaded it?

It is. It is also not only possible but common for a virus signature to exist in a clean (non-infected) file. In the trade, that is known as a false positive. Signature based antivirus programs compare a series of bytes present in a known virus to every byte in every piece of code that passes through them. On occasion, the "signature" code is not the damaging code of the virus, but just a recognizable piece of the virus code. It is possible to duplicate enough of that signature, in benign code in the process of writing programs, to cause it to be recognized by the antivirus as belonging to the virus, even though the virus "warhead" is not part of the code. The signature files for each of the antivirus programs can be somewhat different, and so you can have code declared to be a virus by one scanner, but not by another. 


The problem, when your antivirus flags code as matching a virus signature and someone else's antivirus does not, is trying to figure out which is the error. Did your antivirus flag a virus that theirs missed or did yours flag a false positive? The wise thing to do if the file is not critical is to play it safe. There is nothing wrong with warning your friends about such a finding, even if you cannot confirm that it is not false positive. If your antivirus has it right, then you can save them a world of hurt. If your antivirus is wrong, they can take special care to be sure theirs is not just missing it.


Many antivirus programs have a way to send the suspect file to the antivirus maker for analysis. There are also websites that will allow you to compare the findings by a variety of antivirus programs on a search of the file name.


http://en.wikipedia.org/wiki/Antivirus_software#Problems_caused_by_false_positives



http://www.techsupportalert.com/content/how-report-malware-or-false-positives-multiple-antivirus-vendors.htm

slartabartfast

The wise thing to do if the file is not critical is to play it safe. There is nothing wrong with warning your friends about such a finding, even if you cannot confirm that it is not false positive. If your antivirus has it right, then you can save them a world of hurt. If your antivirus is wrong, they can take special care to be sure theirs is not just missing it.

Providing you take care not to damage an innocent vendors good reputation for supplying clean files...

Jonbouy

slartabartfast

The wise thing to do if the file is not critical is to play it safe. There is nothing wrong with warning your friends about such a finding, even if you cannot confirm that it is not false positive. If your antivirus has it right, then you can save them a world of hurt. If your antivirus is wrong, they can take special care to be sure theirs is not just missing it.

Providing you take care not to damage an innocent vendors good reputation for supplying clean files...

I assume that all vendors are innocent, regardless of whether they have infected files for download or not. Unless you are visiting a malicious website, infected files are not deliberately placed there by the merchant, who is as much a victim as anyone.  If you are concerned about the "reputation" of the vendor, the best thing you can do is to contact him and let him know what you have found. He then has the option to purge his code, or report the false positive to the antivirus maker and request an exception for his file.


Most false positives that I have downloaded, affect precisely these small operations. With some notable exceptions, a file that millions of people download daily which an antivirus falsely flags will be fixed quickly, or the antivirus vendor will add it to their false positive list. The vendor can put a notice on their website acknowledging that the file is incorrectly flagged by antivirus X, with links to other antivirus scanner results, but the casual user may think this is just part of the scam. This kind of thing is a potential nightmare for the vendor.


Still as a user, I would prefer to have a false su****ion raised than to miss a real virus that my scanner does not catch. 


edit Apparently the forum software has decided that I have intended to post a racial slur against persons of Hispanic ancestry cleverly hidden in the noun form of su****ious...er doubtful about the integrity or truthfulness of.