Author Topic: RealCleaner - RealPlayer  (Read 6546 times)

0 Members and 1 Guest are viewing this topic.

Offline Staticguy

  • Super Poster
  • ***
  • Posts: 1427
RealCleaner - RealPlayer
« on: March 13, 2013, 10:20:26 PM »
Hi,

Yesturday I updated my RealPlayer and I did a full system scan with Avast!8 Free Edition and Malwarebytes Antimalware Free Edition it didn't show up any detection. I then did a full system scan with SuperAntiSpyware Free Edition and it detected this file called RealCleaner and the detection name is Trojan.Agent/Gen-FraudScan[Prod]. Location of this file is on C:\Program Files(x86)\Real\RealPlayer\RealCleaner.EXE.

Is this a legit detection or a false warning? I did some research yesturday but couldn't come up with any concrete evidence if this is true or false? Please advice. However i couldn't give post a screenshot of this because file is a bit big? That file is now deleted and in quarantine. Log file of SuperAntiSpyware said this Trojan.Agent/Gen-FraudScan[Prod]

Did anyone of you here have experienced this?
   
« Last Edit: March 13, 2013, 10:24:42 PM by Staticguy »
DELL Inspiron 15" 7000 Gaming, Windows 10 Home Version 21H1 (OS Build 19043.1237), Trend Micro Maximum Security 2021 (17.0.1333), Avast SecureLine VPN (5.12.5655), Windows Firewall, Unchecky 1.2

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37698
Re: RealCleaner - RealPlayer
« Reply #1 on: March 13, 2013, 10:25:41 PM »
upload suspicious file(s) to www.virustotal.com and test with 40+ malware scanners
you may post link to scan result here....

the best to answer questions regarding SAS detections would be in SAS forum   http://forums.superantispyware.com/

Offline Staticguy

  • Super Poster
  • ***
  • Posts: 1427
Re: RealCleaner - RealPlayer
« Reply #2 on: March 13, 2013, 10:44:02 PM »
https://www.virustotal.com/en/file/87df506864cb2cd5102d90275f96947c61ef4eb79f093c50a9e4418f70f53a28/analysis/1363210831/

Posted my message on the SuperAntiSpyware forum and MalwareBytes' AntiMalware Forum.
DELL Inspiron 15" 7000 Gaming, Windows 10 Home Version 21H1 (OS Build 19043.1237), Trend Micro Maximum Security 2021 (17.0.1333), Avast SecureLine VPN (5.12.5655), Windows Firewall, Unchecky 1.2

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37698
Re: RealCleaner - RealPlayer
« Reply #3 on: March 13, 2013, 11:43:08 PM »
seems like False positive detection...
and what does SAS  [prod]  mean ?

Offline Staticguy

  • Super Poster
  • ***
  • Posts: 1427
Re: RealCleaner - RealPlayer
« Reply #4 on: March 13, 2013, 11:45:23 PM »
Hi Pondus,

Just got confirmation from SuperAntiSpyware forum that this is not a false detection and it's a fake antimalware! Can you please pass this information to the moderators and to the Avast Team to inform them and update avast! 8 detection capabilities. Thanks. I will report this to virus at avast dot com.
DELL Inspiron 15" 7000 Gaming, Windows 10 Home Version 21H1 (OS Build 19043.1237), Trend Micro Maximum Security 2021 (17.0.1333), Avast SecureLine VPN (5.12.5655), Windows Firewall, Unchecky 1.2

Offline Staticguy

  • Super Poster
  • ***
  • Posts: 1427
Re: RealCleaner - RealPlayer
« Reply #5 on: March 14, 2013, 12:18:45 AM »
Continuing from my above message. I have reported this to virus at avast dot com.

Since MBAM didn't detect this threat i found this from MBAM forum http://forums.malwarebytes.org/index.php?showtopic=97240

I even didn't double click the RealCleaner icon from the RealPlayer folder. i just did a full system scan from SuperAntiSpyware and it detected that. I also didn't get any pop up dialog box or notification from RealCleaner.
DELL Inspiron 15" 7000 Gaming, Windows 10 Home Version 21H1 (OS Build 19043.1237), Trend Micro Maximum Security 2021 (17.0.1333), Avast SecureLine VPN (5.12.5655), Windows Firewall, Unchecky 1.2

Offline Pondus

  • Probably Bot
  • ****
  • Posts: 37698
Re: RealCleaner - RealPlayer
« Reply #6 on: March 14, 2013, 12:46:09 AM »
Hi Pondus,

Just got confirmation from SuperAntiSpyware forum that this is not a false detection and it's a fake antimalware! Can you please pass this information to the moderators and to the Avast Team to inform them and update avast! 8 detection capabilities. Thanks. I will report this to virus at avast dot com.
that is what you do if you upload the file to avast lab

Offline Staticguy

  • Super Poster
  • ***
  • Posts: 1427
Re: RealCleaner - RealPlayer
« Reply #7 on: March 14, 2013, 01:54:27 AM »
Did u get my mail i send it from my yahoo account.
DELL Inspiron 15" 7000 Gaming, Windows 10 Home Version 21H1 (OS Build 19043.1237), Trend Micro Maximum Security 2021 (17.0.1333), Avast SecureLine VPN (5.12.5655), Windows Firewall, Unchecky 1.2

Offline Staticguy

  • Super Poster
  • ***
  • Posts: 1427
Re: RealCleaner - RealPlayer
« Reply #8 on: March 14, 2013, 02:27:27 AM »
One of the staff from malwarebytes antimalware forum wrote this:

I was able to retrieve the file you uploaded to virustotal from the link in the avast forum. This is a false positive detection on Superantispywares part. Notice on virustotal they are the only one to detect it out of 40+ av companies? This is a legit component of realplayer. If you right click the file and hit properties it has a valid signature signed by realnetworks.

There is a realcleaner rogue but its not in this location ever.

This is where the realcleaner rogue is located:

C:\Program Files\realcleaner\realcleaner.exe

This is where the legit realcleaner is located:

C:\Program Files(x86)\Real\RealPlayer\RealCleaner.EXE.

Sigcheck

publisher................: RealNetworks, Inc.
product..................: RealCleaner
internal name............: RealCleaner
copyright................: Copyright © RealNetworks, Inc. 1995-2012
original name............: RealCleaner.exe
signing date.............: 9:03 PM 3/6/2013
signers..................: RealNetworks, Inc.; Thawte Code Signing CA - G2; thawte Primary Root CA
file version.............: 16.0.1.18
description..............: RealCleaner

I have also gave another mail to virus at avast dot com about this discarding my 1st mail. I have also given you a mail discard it if you want at your discretion.
« Last Edit: March 14, 2013, 02:42:19 AM by Staticguy »
DELL Inspiron 15" 7000 Gaming, Windows 10 Home Version 21H1 (OS Build 19043.1237), Trend Micro Maximum Security 2021 (17.0.1333), Avast SecureLine VPN (5.12.5655), Windows Firewall, Unchecky 1.2

Offline Staticguy

  • Super Poster
  • ***
  • Posts: 1427
Re: RealCleaner - RealPlayer
« Reply #9 on: March 14, 2013, 03:41:31 AM »
Thanks Pondus just now i reported as false positive via the SuperAntiSpyware program. It will take some time in the next update or two for the definition files to SuperAntiSpyware. Great to see you in MBAM forum and takes for posting the file  ;D
DELL Inspiron 15" 7000 Gaming, Windows 10 Home Version 21H1 (OS Build 19043.1237), Trend Micro Maximum Security 2021 (17.0.1333), Avast SecureLine VPN (5.12.5655), Windows Firewall, Unchecky 1.2