PT10.3.2 flagged as a rootkit virus

[dave911]

FYI - I just installed 10.3.2 on W7 and Norton Power Eraser flags it as a rootkit virus.
Regular virus scanner does not see it.

[dave911]

Kapernsky say the Pace License Support Services file is unsigned.
Could be that makes PT look bad.
This is on a clean W7 install and it goes away on PT uninstall.
Avid?

[dave911]

Amazing, in 20 minutes of searching the Avid site I find no way to contact Avid regarding a problem with their software without paying for "support".

I can't think of any other company, large or small, that gives such terrible customer service.

In fact, over 13 years every difficult problem I've had with "my" system has been fixed by a software update.

[Darryl Ramm]

Originally Posted by dave911

Amazing, in 20 minutes of searching the Avid site I find no way to contact Avid regarding a problem with their software without paying for "support".

I can't think of any other company, large or small, that gives such terrible customer service.

In fact, over 13 years every difficult problem I've had with "my" system has been fixed by a software update.

Avid's lack of easy to deal with support can be annoying but what did you want to contact them about? If its earth shattering news somebody will see it here. If its just yet another confused virus scanner you should complain to the virus scanner manufactures. Remember to disable all that anti-virus junk when actually using Pro Tools.

If software updates solve all your problems that an endorsement thing are workign well. Right? I'm just not sure what you are complaining about.

Darryl

[ChuckS]

The reason it is flagged is that the Norton community has reported too few or no installs for that version. PT, mmerefresh and even stuff like UVIWorkstation are flagged because no info is available for the most recent versions, not that it really is a root kit or virus.

[dave911]

It is flagged as a rootkit by two of the largest and most respected security companies either because it is or because the file security certs. are wrong.
This has nothing to do with reputation scans.

No previous version of PT has had this problem and none of the other tens of thousands of files on any of my computers do.

Have either of you even checked this?
Do you know what a rootkit is?
Without virus scanning the internet would collapse in about 1 minute and every computer connected to it would be under botnet control.

What I want from Avid is simple, a place to issue a bug report and get a timely response.
You can either assume you customers are always wrong or you can check out the problem. This is a potential security issue for every user, responsible companies check this kind of thing out fast.
I have done everything I can to veritfy it is not specific to my system, your suggestion is to ignore it and assume you know better than the security scanners - no thanks.

As far as Avid's past responses, no it's not OK for users to spend hours trouble-shooting a problem with "their " system because they cannot get a response from Avid that would tell them it's a software bug.

[jasonthurley]

Originally Posted by dave911

Do you know what a rootkit is?
Without virus scanning the internet would collapse in about 1 minute and every computer connected to it would be under botnet control.

Have you thought about switching to MAC?

[Darryl Ramm]

Originally Posted by dave911

It is flagged as a rootkit by two of the largest and most respected security companies either because it is or because the file security certs. are wrong.
This has nothing to do with reputation scans.

Bull. You are just seeing warnigns you don't understand and are running around foaming at the mouth about them.

There is no such thing as a "file security cert". Maybe you meant something else.

Kaspersky AV has flagged iLok before as a rootkit, its pretty hard to determined non-heuristically they are not a malicious rootkit.

Norton Power Eraser in particular got a very crappy reputation when it first came out and it was busy running around and flagging core parts of Windows as a rootkit and deleting them and trashing people's Windows installs. I hope it has gotten a lot better after that God awful start. But its still not something I see as any need to let loose on my PCs. As with many of these programs the anti-virus programs are often worse than many of the malware, especially when you factor in the chance of infection (assuming you have some common sense and behave carefully on your machine). Microsoft is doing a good job with Security Essentials (and frequent updates for their malicious software removal tools), ultimately these third party AV/scareware/bloatware apps should die off and go away.

Originally Posted by dave911

No previous version of PT has had this problem and none of the other tens of thousands of files on any of my computers do.

That is not true. Kaspersky has certainly falsely bounced Pace's iLok software before.

Originally Posted by dave911

Have either of you even checked this?
Do you know what a rootkit is?
Without virus scanning the internet would collapse in about 1 minute and every computer connected to it would be under botnet control.

What I want from Avid is simple, a place to issue a bug report and get a timely response.
You can either assume you customers are always wrong or you can check out the problem. This is a potential security issue for every user, responsible companies check this kind of thing out fast.
I have done everything I can to veritfy it is not specific to my system, your suggestion is to ignore it and assume you know better than the security scanners - no thanks.

As far as Avid's past responses, no it's not OK for users to spend hours trouble-shooting a problem with "their " system because they cannot get a response from Avid that would tell them it's a software bug.

You seem to be the only person who has/is worried about this. Stop wasting your time here. Buy an ASC and contact Avid so they can help you with *your* problem. But even more productively contact the anti-virus vendors as I've already pointed out. This is likely nothing more than the fairly common problem of a false positive from these AV packages. If it was a serious issue we'd be seeing much more than one isolated complaint.

And yes I certainly know what a rootkit is, I've spent time workings with security and AV researchers, was one of the first folks helping those researchers utilize virtual machines to improve their research.

Darryl

[dave911]

The files are signed, the signers use certs. to authenticate who they are.
I have never seen this problem before.
I didn't ask your "expert" opinion on what is wrong or how to deal with it.
If you don't see it as an issue that concerns you, there's lots of other threads.

[Emcha_audio]

Originally Posted by dave911

The files are signed, the signers use certs. to authenticate who they are.
I have never seen this problem before.
I didn't ask your "expert" opinion on what is wrong or how to deal with it.
If you don't see it as an issue that concerns you, there's lots of other threads.

This is a USER forum, Avid posts here as a courtesy to us, but they are not obligated to. This forum is for USERs to get help from other USERs. So if you post here then you are actually giving permission to other USERs to answer you and post about what you are saying. You don't want any other USERs to answer you? Don't post here, buy an ASC code and call Avid directly.