Wagnardsoft Forum

BenYeeHua wrote:

Lery wrote:Hello. When I extract the files, Windows 10 Windows Defender immediately finds malware. It is detecting a Trojan:Win32/Vapres.N!cl. Can you provide information on this detection please?

Strange, it don't reported by the Microsoft on VirusTotal.
https://www.virustotal.com/en/file/a888 ... 468368875/

For checking all files inside the exe/winzip, I also repack it into zip and upload it to scan, still most files ticked as green/No virus detected.
https://www.virustotal.com/en/file/d580 ... 468369196/

For the type of virus detected.
https://www.microsoft.com/security/port ... n32/Varpes
https://www.microsoft.com/security/port ... terprise=0
---
So yup, it is likely a false alarm, or you has downloaded difference files.
I recommend you to check the SHA1 for the exe that you downloaded, as shown on the first post.
SHA1: D8D40E136805F22B59CAD0CDE68F9A65D81BFD49

Lery wrote:

BenYeeHua wrote:

Lery wrote:Hello. When I extract the files, Windows 10 Windows Defender immediately finds malware. It is detecting a Trojan:Win32/Vapres.N!cl. Can you provide information on this detection please?

Strange, it don't reported by the Microsoft on VirusTotal.
https://www.virustotal.com/en/file/a888 ... 468368875/

For checking all files inside the exe/winzip, I also repack it into zip and upload it to scan, still most files ticked as green/No virus detected.
https://www.virustotal.com/en/file/d580 ... 468369196/

For the type of virus detected.
https://www.microsoft.com/security/port ... n32/Varpes
https://www.microsoft.com/security/port ... terprise=0
---
So yup, it is likely a false alarm, or you has downloaded difference files.
I recommend you to check the SHA1 for the exe that you downloaded, as shown on the first post.
SHA1: D8D40E136805F22B59CAD0CDE68F9A65D81BFD49

Ok, I compared the SHA1 for the file DDU v16.0.0.4.exe downloaded and it matches. However, the trojan is verified on all virus websites. So it does make me nervous.

Wagnard wrote:

Lery wrote:

BenYeeHua wrote: Strange, it don't reported by the Microsoft on VirusTotal.
https://www.virustotal.com/en/file/a888 ... 468368875/

For checking all files inside the exe/winzip, I also repack it into zip and upload it to scan, still most files ticked as green/No virus detected.
https://www.virustotal.com/en/file/d580 ... 468369196/

For the type of virus detected.
https://www.microsoft.com/security/port ... n32/Varpes
https://www.microsoft.com/security/port ... terprise=0
---
So yup, it is likely a false alarm, or you has downloaded difference files.
I recommend you to check the SHA1 for the exe that you downloaded, as shown on the first post.
SHA1: D8D40E136805F22B59CAD0CDE68F9A65D81BFD49

Ok, I compared the SHA1 for the file DDU v16.0.0.4.exe downloaded and it matches. However, the trojan is verified on all virus websites. So it does make me nervous.

On what website you are checking this?

Lery wrote:

Wagnard wrote:

Lery wrote:
Ok, I compared the SHA1 for the file DDU v16.0.0.4.exe downloaded and it matches. However, the trojan is verified on all virus websites. So it does make me nervous.

On what website you are checking this?

Here you go: https://www.microsoft.com/security/port ... au.A!plock

This is odd. I noticed just now that the file downloaded is DDU v16.0.0.4.exe. It no longer is detected by windows defender as malicious. I'm almost certain the file I downloaded earlier had guru3d in the name. I followed the links from guru3d, to this forum, where I downloaded the file. No different than just now. Very strange.

Wagnard wrote:

Lery wrote:

Wagnard wrote: On what website you are checking this?

Here you go: https://www.microsoft.com/security/port ... au.A!plock

This is odd. I noticed just now that the file downloaded is DDU v16.0.0.4.exe. It no longer is detected by windows defender as malicious. I'm almost certain the file I downloaded earlier had guru3d in the name. I followed the links from guru3d, to this forum, where I downloaded the file. No different than just now. Very strange.

Guru3d probably repack the file.
If you want the original file, you know where to go