Author Topic: Trojan:Win32/Critet.BS - False positive from Defender?  (Read 55337 times)

0 Members and 1 Guest are viewing this topic.

Offline Alchemist

  • Newbie
  • *
  • Join Date: Oct 2015
  • Posts: 1
  • Karma: 0
    • View Profile
Trojan:Win32/Critet.BS - False positive from Defender?
« on: March 16, 2018, 12:38:38 pm »
I have just had Windows Repair Pro quarantined and removed by Windows Defender as a severe risk of infection by Trojan:Win32/Critet.BS
I have repeatedly downloaded and tried to reinstall but the effect is the same.
I presume that this is a false positive but can you confirm ?
Better to be safe than sorry.
Any plans to look into this issue, if it is a real one, and liaise with Microsoft to prevent a recurrence and issue an update ?
I really rely on Windows Repair.

Offline Boggin

  • Global Moderator
  • Hero Member
  • *****
  • Join Date: Jul 2014
  • Posts: 10182
  • Location: UK
  • Karma: 122
    • View Profile
Re: Trojan:Win32/Critet.BS - False positive from Defender?
« Reply #1 on: March 16, 2018, 02:20:50 pm »
A little while ago my Norton Security kicked out the .exe of Windows Repair, even though it was already installed and I had to have it whitelisted before I could install it again.

That was done by adding www.tweaking.com to the whitelist, but while this can be done in Windows Defender, it requires a file or folder.

https://support.microsoft.com/en-us/help/4028485/windows-10-add-an-exclusion-to-windows-defender-antivirus

So you may need to boot up into Safe Mode with Networking to download the program then see if you can open Windows Defender in that mode to add it as an exclusion.

I've just downloaded 4.0.15 and Norton said it was safe, so it is definitely a false positive.

Offline fabrikator

  • Newbie
  • *
  • Join Date: Apr 2014
  • Posts: 33
  • Location: Southern USA
  • Karma: 1
    • View Profile
Re: Trojan:Win32/Critet.BS - False positive from Defender?
« Reply #2 on: March 17, 2018, 11:38:56 am »
I have some information that may shine some light on this issue. I run Win7 PRO with Microsoft Security Essentials.

Shane posted v4.0.15 at 8:20 P.M. 3-14-18

I downloaded and installed v4.0.15 early A.M. of 3-15-18 with no virus detection problems at all. The v4.0.15 worked fine.

UNTIL  .....

Microsoft issues MSSE virus update v1.263.672.0 which I downloaded and installed this morning, A.M. 3-17-18 ...

AND THEN everything went to hell with v4.0.15, MSSE showing the Trojan Win32/Critet.BS virus.

I could not run or re-download v4.0.15 after the MSSE v1.263.672.0 update.

HOWEVER, there is NO problems with Windows Repair v4.0.14. I re-install it and am using it now until SHANE can FIX THIS !!!

Thanks,

fabrikator

Offline technet

  • Newbie
  • *
  • Join Date: Mar 2018
  • Posts: 2
  • Karma: 0
    • View Profile
Re: Trojan:Win32/Critet.BS - False positive from Defender?
« Reply #3 on: March 17, 2018, 03:53:57 pm »
Getting the same report here. It really is a false positive?

Offline Boggin

  • Global Moderator
  • Hero Member
  • *****
  • Join Date: Jul 2014
  • Posts: 10182
  • Location: UK
  • Karma: 122
    • View Profile
Re: Trojan:Win32/Critet.BS - False positive from Defender?
« Reply #4 on: March 17, 2018, 04:07:59 pm »
Getting the same report here. It really is a false positive?

After reading the first report, I downloaded the program, although I already have the Pro version and Norton Security didn't snag anything which I believe it would have had there been something there.

You will need to whitelist it and contact MS to sort out their Definitions for their AV programs.

Offline Boggin

  • Global Moderator
  • Hero Member
  • *****
  • Join Date: Jul 2014
  • Posts: 10182
  • Location: UK
  • Karma: 122
    • View Profile
Re: Trojan:Win32/Critet.BS - False positive from Defender?
« Reply #5 on: March 17, 2018, 04:23:12 pm »
@ fabrikator - I'll pass this on about 4.0.14 not being affected by this.

Offline ergo

  • Newbie
  • *
  • Join Date: Oct 2017
  • Posts: 16
  • Karma: 0
    • View Profile
Re: Trojan:Win32/Critet.BS - False positive from Defender?
« Reply #6 on: March 17, 2018, 04:32:06 pm »
I would have thought that that shouldn't be our job, we just purchased the license.  I had the impression that the program is supposed was developed with Microsoft's blessing.  It's not right for every user to have to struggle with Microsoft to make sense of it.  I thought the idea was you do the work and we pay for the license.  So now we're supposed to multiply efforts between us all when we have no idea what is going on.

I don't want to whitelist it because maybe how do I know the program doesn't actually have a Trojan in it?  As it is I'm getting paranoid with all this cyber hacking.  E.g., from what I read I'm pretty sure Kaspersky virus checker seems to have been hacking user's computers on behalf of Putin (the US govt is barring its use)

I just got the trojan message from Microsoft Defender today, I bet there will be lots more than already reported it.  Isn't it Tweaking.com's job to make sure that we are safe?

Rani

Offline Boggin

  • Global Moderator
  • Hero Member
  • *****
  • Join Date: Jul 2014
  • Posts: 10182
  • Location: UK
  • Karma: 122
    • View Profile
Re: Trojan:Win32/Critet.BS - False positive from Defender?
« Reply #7 on: March 17, 2018, 04:44:01 pm »
Read Reply #1 and Reply #2.

I've passed on what fabrikator had found to my Support which will be passed onto Shane.

As you will see from my Reply #1 I've also once experienced an AV program conflict which eventually went.

Offline coover

  • Jr. Member
  • **
  • Join Date: Jul 2012
  • Posts: 60
  • Karma: 0
    • View Profile
Re: Trojan:Win32/Critet.BS - False positive from Defender?
« Reply #8 on: March 17, 2018, 04:54:19 pm »
After much consternation while trying to place the portable version of 4.0.0.15 onto my hard drive and then pinning a shortcut on the taskbar, my preferred method of installation, I did this ... 1. I turned off Defender "Real-Time Protection" 2. Downloaded the portable version of 4.0.0.15, 3. Extracted the download, 4. Placed the extracted file in the location I prefer, 6. Pinned the .exe onto the taskbar, and 7. Excluded the 4.0.0.15 folder in the location where I placed it.

But I agree with ergo (above) who said that the user should not have to go through all this hassle in order to use the software. Tweaking.com should have tested the software against all the major AV applications before releasing it. That said, however,  fabrikator mentioned that defender did not catch the (in this case) false positive at the time it was released. It was only after an Defender update that the false positive was reported. So, in this case, the problem was not with Tweaking.com. But the problem did become tweaking.com's when the false reports started coming, and they must fix the problem as soon as possible. I expect a new version, 4.0.0.16 with the fix out soon.

Offline Boggin

  • Global Moderator
  • Hero Member
  • *****
  • Join Date: Jul 2014
  • Posts: 10182
  • Location: UK
  • Karma: 122
    • View Profile
Re: Trojan:Win32/Critet.BS - False positive from Defender?
« Reply #9 on: March 17, 2018, 05:16:15 pm »
I disagree - the problem is with WD and MSE Definition updates and MS should be fixing it.

When an AV program starts blocking a legit program then the protocol is to report that to the AV vendor as I did when I had problems with Norton kicking it out.

Norton has also blocked AdwCleaner for me but that soon passed as the Definitions were updated, which may be the case after the next WD and MSE updates.

However, I have passed this on.

Offline fabrikator

  • Newbie
  • *
  • Join Date: Apr 2014
  • Posts: 33
  • Location: Southern USA
  • Karma: 1
    • View Profile
Re: Trojan:Win32/Critet.BS - False positive from Defender?
« Reply #10 on: March 17, 2018, 06:38:35 pm »
The cause of all of this is Microsoft Security Essentials & Microsoft Defender virus update v1.263.672.0 which came out this morning 3-17-18.

Yesterday Windows Repair v4.0.15 was FINE but after Microsoft's v1.263.672.0 update it shows the Critet virus in the WinRepair.exe file.

This is a Microsoft ERROR in their virus defs. Strangly, Windows Repair v4.0.14 remains clean.

I had the same thing happen several months ago with Hoverdesk RegCleaner and Avast's Piriform CCleaner. Both were fine until

Microsoft's "Weekend Warriors" released a virus update. Sadly, it took Microsoft 2 months to fix it.

It would seem to me that Shane could do some scripting magic in a new version and fix this, but I don't know.

One thing I DO know is that if you whitelist an .EXE file after it has been flagged with a virus, false positive or not, your are taking a big

chance.  That's my 2 cents worth.

fabrikator

Offline coover

  • Jr. Member
  • **
  • Join Date: Jul 2012
  • Posts: 60
  • Karma: 0
    • View Profile
Re: Trojan:Win32/Critet.BS - False positive from Defender?
« Reply #11 on: March 17, 2018, 07:49:16 pm »
Yes, I believe MS should fix their application as soon as they can, but I would not rely on them to do so. If making changes to 4.0.15 is relatively easy, I would not wait for MS to do their thing. If MS takes a week to fix it, Windows Repair 4.0.15 is dead in the water for those folks using Defender, and Tweaking.com's chances to sell Professional  Versions of this software are lessened, even after MS makes the fix, as some folks will decide their free trial failure is enough not to come back for the next version.   
« Last Edit: March 17, 2018, 07:51:34 pm by coover »

Offline ergo

  • Newbie
  • *
  • Join Date: Oct 2017
  • Posts: 16
  • Karma: 0
    • View Profile
Re: Trojan:Win32/Critet.BS - False positive from Defender?
« Reply #12 on: March 17, 2018, 11:03:57 pm »
Harking back, though. Why on earth is this our problem to struggle with?  We pay the license, they provide the service.  Telling every one of us to  struggle with  Microsoft is ridiculous - it dramatically multiplies the effort required compared if Tweaking just dealt with the problem itself.  How do you expect customer loyalty if you just dismiss us as "you're on your own" - over a problem that a large number of people are facing. 

I can understand if this takes you some time to deal with, but don't give us homework you don't want to deal with!

Offline Boggin

  • Global Moderator
  • Hero Member
  • *****
  • Join Date: Jul 2014
  • Posts: 10182
  • Location: UK
  • Karma: 122
    • View Profile
Re: Trojan:Win32/Critet.BS - False positive from Defender?
« Reply #13 on: March 18, 2018, 01:45:09 am »
Harking back, though. Why on earth is this our problem to struggle with?  We pay the license, they provide the service.  Telling every one of us to  struggle with  Microsoft is ridiculous - it dramatically multiplies the effort required compared if Tweaking just dealt with the problem itself.  How do you expect customer loyalty if you just dismiss us as "you're on your own" - over a problem that a large number of people are facing. 

I can understand if this takes you some time to deal with, but don't give us homework you don't want to deal with!

A few years back McAfee released a Definitions update that blocked Internet connectivity - are you saying that the ISPs should have changed the way they delivered broadband - because that is the equivalent of the now WD and MSE Definitions vs WR.

Offline grimley

  • Newbie
  • *
  • Join Date: Oct 2017
  • Posts: 6
  • Karma: 0
    • View Profile
Re: Trojan:Win32/Critet.BS - False positive from Defender?
« Reply #14 on: March 18, 2018, 11:25:34 am »
Removed .15 and tried to install .14.
Installer reports an error (pointing to the install directory).
Defender barfs.

Offline jpm

  • Administrator
  • Full Member
  • *****
  • Join Date: Mar 2015
  • Posts: 185
  • Karma: 36
    • View Profile
    • Tweaking.com
Re: Trojan:Win32/Critet.BS - False positive from Defender?
« Reply #15 on: March 18, 2018, 11:29:19 am »
I think you misunderstand how the entire antivirus thing works. Microsoft, Malwarebytes, Avira - all of them have false positive. Hell. Malwarebytes detected some of my photos the other day as virus (which BTW isn't even possible). They do it as a matter of course.

The dirty secret is some company's - the big ones  - are white listed. They can do whatever they like and release whatever they like. That is dangerous. Small companies are not - we use something called code signing which validates our product - but sometimes that is plain ignored, missed and we get  "false positive" detections

The antivirus companies further more depend on from known lists - most of which are t the same. Meaning they all the detect the same known thing. Hence., they realty detect something that isn't known -- until someone discovers it and it comes on the list.

To try and get around this they use heuristics  that try and uses that something may be in the realm of a viral infection -- that leads to more false positives.  Don't believe me, read it from one of the best utility programmers ever. https://www.nirsoft.net/false_positive_report.html  This is why you see "generic" or "Trojan.gen" a lot. meaning they have no idea what this is and it could be something generic -- or nothing.

There is no way for us to know when and if someone will detect our software as a false positive -- and it happens a lot. We have to wait for them to make a mistake and report it to them. Then wait for them to fix it. Which sucks for us.

Hell I wrote a company called cylance like 3 months ago and they still haven't fixed it. I suppose that is why no one uses cylance. Clearly, they don't keep pace.
 
In this case Microsoft plain screwed up something and detect a crapload of software with the same thing.
https://forum.kerbalspaceprogram.com/index.php?/topic/172357-trojanwin32critetbs/

We reported it, they fixed it - I don't expect and apology from them. But that is how the system unfortunately works. It sucks, but that is what it is.

We do our job correctly and produce quality clean software. If you don't want to white list it, that's your call. Just wait for the next update and we will be cleared.   But you, as consumers have to take a stand to help fight the false positive problem.  Authors have been fighting it to no avail.


I would have thought that that shouldn't be our job, we just purchased the license.  I had the impression that the program is supposed was developed with Microsoft's blessing.  It's not right for every user to have to struggle with Microsoft to make sense of it.  I thought the idea was you do the work and we pay for the license.  So now we're supposed to multiply efforts between us all when we have no idea what is going on.

I don't want to whitelist it because maybe how do I know the program doesn't actually have a Trojan in it?  As it is I'm getting paranoid with all this cyber hacking.  E.g., from what I read I'm pretty sure Kaspersky virus checker seems to have been hacking user's computers on behalf of Putin (the US govt is barring its use)

I just got the trojan message from Microsoft Defender today, I bet there will be lots more than already reported it.  Isn't it Tweaking.com's job to make sure that we are safe?

Rani

Offline ergo

  • Newbie
  • *
  • Join Date: Oct 2017
  • Posts: 16
  • Karma: 0
    • View Profile
Re: Trojan:Win32/Critet.BS - False positive from Defender?
« Reply #16 on: March 18, 2018, 11:39:22 pm »
Boggin, are you serious?  Is it really that easy for you to write all of us off, we're on our own, have to fend for ourselves even though you're talking about possibly hundreds of people struggling with microsoft over something that shouldn't be our problem to begin with?

How about this.   I don't want to waste my time over something that is  not my responsibility.  So how about if you all offer us refunds for the remainder of our subscription?

Microsoft wiped out the software.  Even if I wanted to, I don't think it will let me reinstall it.  And why would I want to, when I'm not sure it's a trojan?

Why is it my job - along with everyone else - to deal with this?

And why should I trust you enough to whitelist you?

So I'd say, rather than blowing us all off - and especially given that our software has been eviscerated - why don't you owe all the subscribers with this problem their money back for the remaining time?

I don't care about the money, it's about acting like a decent business that is willing to deal with its own problems with Microsoft.

*.* the way I read the messages from the program, I had the impression that Tweaking was joined at the hip with Microsoft.

Jeez.  Do you think we have so much time to struggle with something that's not worth our time?

Offline Boggin

  • Global Moderator
  • Hero Member
  • *****
  • Join Date: Jul 2014
  • Posts: 10182
  • Location: UK
  • Karma: 122
    • View Profile
Re: Trojan:Win32/Critet.BS - False positive from Defender?
« Reply #17 on: March 19, 2018, 01:45:44 am »
@ ergo - I've removed your duplicate post, but haven't you read or understood a word that jpm has posted.

BTW - I'm only a volunteer on this forum and have no authority for the administration of any of Tweaking.com's programs - and while it has been known for MS techs to have used the repair program, they are not "joined at the hip" and are two different companies.

When Norton kicked out my Pro version I contacted Norton and they white listed it for me and I left it white listed for about a month before removing it from the white list to see if it still conflicted with it - it didn't.

I don't know if Norton moderated their Definitions or the newer Definitions moved on so that it no longer thought it a threat, but MS won't do anything about it if they don't know about it - which is why I've advised to contact MS.

When my Pro version updated to 4.0.15 through the program, there was no such alert and when I did a manual download, Norton reported it as safe, which is good enough for me.

The fault is not with the program but with MS, so that is who you need to contact to address this other than adding it to the white list.

Tweaking.com is quite safe - read jpm's post.

Offline jpm

  • Administrator
  • Full Member
  • *****
  • Join Date: Mar 2015
  • Posts: 185
  • Karma: 36
    • View Profile
    • Tweaking.com
Re: Trojan:Win32/Critet.BS - False positive from Defender?
« Reply #18 on: March 19, 2018, 08:22:27 am »
People have - because of good marketing - the belief that antivirus companies keep them safe and are perfect.  I have 20 years in the software business that says that they are mainly full of crap. :)

Antivirus apps are more and more becoming modern day scareware and less and less a protection software.

But to restate what I said, false postives with ALL antivirus apps are commonplace.  When it happens, it is incumbant on the author of the software to notify the AV company detecting them to fix it.

In this case, from reading about other software the was hit with the "Critet.BS " designation (Seems BS stands for BullShit) - it looks like Windows Defender was tagging  that used certian funtions in VB.net programing language.  For those who don;t know, VB.net is a micorosft programming language.

How do you hold Tweaking.com responsible for that?


Offline Boggin

  • Global Moderator
  • Hero Member
  • *****
  • Join Date: Jul 2014
  • Posts: 10182
  • Location: UK
  • Karma: 122
    • View Profile
Re: Trojan:Win32/Critet.BS - False positive from Defender?
« Reply #19 on: March 19, 2018, 03:53:11 pm »
Removed .15 and tried to install .14.
Installer reports an error (pointing to the install directory).
Defender barfs.

Where did you get the download for .14 ?

Offline fabrikator

  • Newbie
  • *
  • Join Date: Apr 2014
  • Posts: 33
  • Location: Southern USA
  • Karma: 1
    • View Profile
Re: Trojan:Win32/Critet.BS - False positive from Defender?
« Reply #20 on: March 19, 2018, 10:47:24 pm »
OK all you tweaking virus experts, I think I'm back in the right place now. I hit the wrong button last time and double posted. Sorry !

We can all carry on about all the virus protection programs giving out false positives, but I'd like Shane or jpm to ponder this :

Why does v4.0.15 get flagged for the Critet virus but v4.0.14 DOES NOT  ??  Something ain't right

And to Boggin, Major Geeks should have v4.0.14. It works just fine.

fab


Offline markus5664

  • Newbie
  • *
  • Join Date: Dec 2017
  • Posts: 3
  • Karma: 1
    • View Profile
Re: Trojan:Win32/Critet.BS - False positive from Defender?
« Reply #21 on: March 20, 2018, 09:26:27 am »
I have Two desktops both up to date and running windows10 and using windows defender anti-virus. My xps420 has no problem with 4.0.15 however, my xps8700 does. Both have the latest updates.(1.263.824). I have submitted the v4.0.15 file to Windows Defender Security Intelligence and am currently awaiting the result analysis. I believe trojan:win32/critet.bs may very well be a false positive. If I try to run 4.0.14 I still show a false positive on my 8700 however, if I download 3.9.32 I have no problem with it. I hope Defender can give a definitive cause.  My problems began on 3/17/18 with windows defender security update 1.263.730, prior to that the new 4.0.15 ran great.

Offline Boggin

  • Global Moderator
  • Hero Member
  • *****
  • Join Date: Jul 2014
  • Posts: 10182
  • Location: UK
  • Karma: 122
    • View Profile
Re: Trojan:Win32/Critet.BS - False positive from Defender?
« Reply #22 on: March 20, 2018, 09:37:23 am »
Thanks for your input to this thread.

Offline markus5664

  • Newbie
  • *
  • Join Date: Dec 2017
  • Posts: 3
  • Karma: 1
    • View Profile
Re: Trojan:Win32/Critet.BS - False positive from Defender?
« Reply #23 on: March 20, 2018, 01:15:57 pm »
Received clean bill of health from Defender.  Updated to 1.263.830.0 per instructions however, still fails showing error with irsetup.exe, defender does not like this installer. In safe mode w/networking I can download program and run it with no problem. I can also shut down defender's malware and use malwarebytes instead. I choose not to white list and will wait to see what happens. I will use safe mode w/networking to run tweaking which is how you are to run it in the first place.

Offline ergo

  • Newbie
  • *
  • Join Date: Oct 2017
  • Posts: 16
  • Karma: 0
    • View Profile
Re: Trojan:Win32/Critet.BS - False positive from Defender?
« Reply #24 on: March 20, 2018, 11:15:45 pm »

A few years back McAfee released a Definitions update that blocked Internet connectivity - are you saying that the ISPs should have changed the way they delivered broadband - because that is the equivalent of the now WD and MSE Definitions vs WR.

Sorry, Bloggin, I probably referred to the wrong company.  I meant to say the Kaspersky virus program is considered unsafe. It's a rather bizarre story. The U.S. government is now banning its use in the federal government.  Ironically, it was Michael Flynn (who had the honor of being fired as a security expert by both Obama and Trump) who a number of years ago flagged it as unsafe and increasing the risk of being hacked.  After Obama fired him, Flynn then started working for Kaspersky - who among other things is closely tied to Putin.  A couple of months ago 60 minutes interviewed Kaspersky in Russia about the evidence they were hacking the US.   What a perfect scheme - sell a virus checker that scans every file in your computer.

And Boggin please don't think I am blasting you over what to do about the virus problem.  Windows 10 won't let me install Tweaker and I am absolutely not comfortable white listing a program given examples such as the one I mentioned (Kaspersky).   I'm not saying that you should be responsible, just that we should not be responsible.   I can't install or use Tweaker, but I'd just let the license lapse rather than spending a ton of time dealing with Microsoft over the issue.

I'm getting confused by this user interface, I hope I haven't sent a double - I can't find my first response