Kabuto detected as Malware

[Koala]

I recently bought the year license for Kabuto and started playing with it. I download the installer to my laptop and Windows Defender detects it as Malware and removes it. Is anyone else experiencing this? I want to get this fixed before ever installing it on a client's computer.

 

[Slaters Kustum Machines]

I recently bought the year license for Kabuto and started playing with it. I download the installer to my laptop and Windows Defender detects it as Malware and removes it. Is anyone else experiencing this? I want to get this fixed before ever installing it on a client's computer.

I haven't specifically used Kabuto, but use a tool by a different vendor called D7II and it's common for Tech and Malware tools to be classified as malware due to the nature of how the tools work. This is why you should disable the current AV on the machine you are working on when running your tools.

 

[Porthos]

Zip and upload the installer here and choose NOT MALWARE.

https://www.microsoft.com/en-us/security/portal/submission/submit.aspx

 

[Koala]

I haven't specifically used Kabuto, but use a tool by a different vendor called D7II and it's common for Tech and Malware tools to be classified as malware due to the nature of how the tools work. This is why you should disable the current AV on the machine you are working on when running your tools.

Yeah, I understand I can disable it but I don't want to disable then install the Kabuto service and once it's re-enabled, have the customer call me asking why is there malware in their computer.

 

[Koala]

Zip and upload the installer here and choose NOT MALWARE.

https://www.microsoft.com/en-us/security/portal/submission/submit.aspx

Nice, just submitted the information. Thanks!

 

[Koala]

Hopefully they can get this white-listed promptly. I don't plan on installing this on any of my client's computers until it's sorted out.

 

[Porthos]

Hopefully they can get this white-listed promptly. I don't plan on installing this on any of my client's computers until it's sorted out.

There usually "fairly" quick.

 

[Slaters Kustum Machines]

Yeah, I understand I can disable it but I don't want to disable then install the Kabuto service and once it's re-enabled, have the customer call me asking why is there malware in their computer.

Fair enough, you should be able to whitelist it as well.

 

[Koala]

Fair enough, you should be able to whitelist it as well.

The client will have the option to install the free monitoring service from m y site, so they might install it without me being there or remotely connected to them. I don't want it to appear as malware coming from my site.

 

[Koala]

Here's a screenshot just in case anyone is wondering the details.

 

[cypress]

I have Kabuto running on a couple machines with MSE and never had an issue with this. I just checked their forums to see if anyone else had an issue like this and nothing came up.

The only issue I did have previously was Kapersky detecting it as a false positive but that was fixed already. Is this issue only happening on this one computer or others as well?

 

[Koala]

I have Kabuto running on a couple machines with MSE and never had an issue with this. I just checked their forums to see if anyone else had an issue like this and nothing came up.

The only issue I did have previously was Kapersky detecting it as a false positive but that was fixed already. Is this issue only happening on this one computer or others as well?

I also found it weird that I believe I'm the only one experiencing this since there's no other reports. I tried it on two machines with the same outcome. I contacted Kabuto and also submitted the file to Microsoft. I'm now playing the waiting game.

 

[Porthos]

What does virus total say about the file. Can you post the VT results.

 

[repairtechinc]

Hey guys - Ian from RepairTech here. This is the first we've heard of Windows Defender detecting Kabuto, if it happens again please let me know and I'll get in touch with them.

Let me know if you have any questions,

Ian

 

[Koala]

UPDATE:

After submitting the file to Microsoft with a brief description, it is now white-listed.

Thanks everyone

 

[nlinecomputers]

Odd that only you are seeing this. Are you certain that your copy is unmolested? I would see what virustotal says about it. You may have just whitelisted a virus embedded copy.

 

[cypress]

UPDATE:

After submitting the file to Microsoft with a brief description, it is now white-listed.

Thanks everyone

Good to know! I just checked the machines they are installed at just in case and no issues.

 

[Krilus]

I have a hard time believing MS would whitelist anything without first doing a forensics scan of it first.
However, stranger things have happen tho I guess.

Odd that only you are seeing this. Are you certain that your copy is unmolested? I would see what virustotal says about it. You may have just whitelisted a virus embedded copy.

 

[Koala]

Odd that only you are seeing this. Are you certain that your copy is unmolested? I would see what virustotal says about it. You may have just whitelisted a virus embedded copy.

Yes, it's odd that I seen no other reports of this. I'm downloading the installer directly from my account page from Repairtech. I did nothing to the files, I was simply downloading them to my computer and it will quickly detect it as malware. I tried it on two machines with the same results. As mentioned, I'm not sure why I was the only one experiencing this.

 

[Porthos]

Hey guys - Ian from RepairTech here. This is the first we've heard of Windows Defender detecting Kabuto, if it happens again please let me know and I'll get in touch with them.

Let me know if you have any questions,

Ian

Now the ClientKabutoSetup is tagged by Defender. I have submitted it to MS.