Malware Variant.Adware.Mplug.39 detected in ovr_sdk_win zip

[AtariHistorian]

Spybot Search & Destroy flags the zips for ovr_sdk_win_0.5.0.1 and 0.6.0.0 as "Variant.Adware.Mplug.39".

I see that another user has already reported this in the development forum.

[cybereality]

All those MD5 hashes appear to be the same as the ones I downloaded from the live site, so I don't believe the files have been tampered with. The strange part is that I have scanned the files you sent, with the paid version of Spybot, and they are still coming up clean. I'm not sure I understand.

[AtariHistorian]

"cybereality" wrote:
All those MD5 hashes appear to be the same as the ones I downloaded from the live site, so I don't believe the files have been tampered with. The strange part is that I have scanned the files you sent, with the paid version of Spybot, and they are still coming up clean. I'm not sure I understand.

I certainly don't have the answer. I can try a few guesses, here's a good one... heuristics Do you have this selected?

selection.png

[cybereality]

Yes, I have heuristics enabled.

[AtariHistorian]

"cybereality" wrote:
Yes, I have heuristics enabled.

I think I'm short on ideas at this point. I'll let you know when/if the vendor responds. Let me know if you have something you want to try.

[TomSD]

Have you guys heard of VirusTotal? You can upload a file there, they'll automatically scan it with 56 antivirus products, and give you the results in real-time. Here's a report for ovr_sdk_win_0.6.0.0.zip:
https://www.virustotal.com/en/file/b5ed ... 433190496/

Spoiler: 1 out of 56 antivirus products deemed this file a threat:
TrendMicro-HouseCall Suspici.F3C24B38

The flagged file within the archive appears to be OculusWorldDemo.exe.

I have first hand experience resolving these sorts of false positives. The way modern antivirus software works is deeply flawed and false positives occur way more often than they should. Reproducing the problem and getting it resolved with the vendor ranges anywhere from painless to impossible. Good luck!

[AtariHistorian]

Update: Resolved.

I (finally) received an email from Spybot asking me to run the scan again. Spybot no longer reports OculusWorld as malware.

[cybereality]

Success!!!