WS1095: WS1095 Virus

[TexScan780D]

Has anyone had trouble with virus infecting WS1095?

Windows Defender

Trojan:Win32/Azden.A!cl

Affected items:

file: C:\Program Files (x86)\Whistler\WS1095\WS1095.exe

file: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Whistler\WS1095 EZ Scan Digital BAse-Mobile Trunking Scanner\EZ-Scan Base-Mobile Digital.lnk

regkey: HKLM\SOFTWARE\Wow6432Node\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Whistler WS1095

startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Whistler\WS1095 EZ Scan Digital BAse-Mobile Trunking Scanner\EZ-Scan Base-Mobile Digital.lnk

uninstall: HKLM\SOFTWARE\Wow6432Node\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Whistler WS1095

 

[Wackyracer]

Yes, I get it with my trx-2.
I am assuming it is a false positive.

 

[TexScan780D]

Yes, I get it with my trx-2.
I am assuming it is a false positive.

I think you are right since WS1095.exe been on my computer for sometime.

 

[BrianG61UK]

Yes, I get it with my trx-2.
I am assuming it is a false positive.

Microsoft are normally quite quick at fixing false positives, but it does depend on there being a few people who have the file in question and have the "send file samples automatically when further analysis is required" feature enabled.

 

[trido]

yes i do, so what do we do?

Has anyone had trouble with virus infecting WS1095?

Windows Defender

Trojan:Win32/Azden.A!cl

Affected items:

file: C:\Program Files (x86)\Whistler\WS1095\WS1095.exe

file: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Whistler\WS1095 EZ Scan Digital BAse-Mobile Trunking Scanner\EZ-Scan Base-Mobile Digital.lnk

regkey: HKLM\SOFTWARE\Wow6432Node\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Whistler WS1095

startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Whistler\WS1095 EZ Scan Digital BAse-Mobile Trunking Scanner\EZ-Scan Base-Mobile Digital.lnk

uninstall: HKLM\SOFTWARE\Wow6432Node\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Whistler WS1095

 

[jdolina]

If you want to feel better about it being a false positive submit to virus total. It will show results from multiple scan engines
https://www.virustotal.com/#/home/upload

Also make sure your malware/virus definitions are up to date for windows.

 

[troymail]

I've seen false positives quiet often ... I end up adding an exception (ignore) to my anti-virus to avoid these things being quarantined.

 

[Ronaldski]

Go to https://www.microsoft.com/en-us/wdsi/filesubmission

Yes make an exception so it won't get deleted, then in turn upload the ws1095.exe file at that link.
In the comments put in the info.

How to make an exception-
Click your windows version at the following link although just select FILE instead of folder in the example at https://forum.maplelegends.com/inde...s-defender-microsoft-security-essential.6688/

 

[AuntEnvy]

I just noticed that my desktop icon wasn't displaying correctly and when I clicked on it to open it said the app can't run on my computer. Is that what is going on here with this post...?

Either way, does anyone know about this? If so, what should I do?

 

[gh6406]

Virus

I just noticed that my desktop icon wasn't displaying correctly and when I clicked on it to open it said the app can't run on my computer. Is that what is going on here with this post...?

Either way, does anyone know about this? If so, what should I do?

I removed the virus when windows defender alerted me to it. I then had to re-install the Whistler WS1095 software and everything is fine. I did NOT lose any data.

 

[AuntEnvy]

I saw something about a trojan being removed or "inspected" by norton automatically the other day. Is that related to the Whistler ezscan 1095 problem?

I guess I'll have to reload the software from Whistler, correct?

 

[BrianG61UK]

You can just reinstall if you still have the setup files.

Or look in the quarantine of your anti-virus and restore any parts of EZ-Scan you find there.

 

[VA3SOM]

Have that detection ALL the time with TRX software too, i just put it all into a folder that has a exception otherwise defender nukes it before the download even finishes. Despite submitting it to MS twice, and them confirming it was not malware.

https://www.virustotal.com/#/file/a5997787ee890a0e13ed1b36adfad16443a0b2b223e917a17effb41175d95728 scan with TRX software that triggered on defender, but never showed on VT oddly.

 

[AuntEnvy]

OK guys, thank you.

I ended up reloading an earlier version and it's fine but it still won't let me download the 233 version. I couldn't figure out how to make an exception yet. It's calling it "Trojan gen 6" I believe, so I'm a little wary of letting it through at this point. I guess I'll just keep the version that's working for now.

 

[VA3SOM]

OK guys, thank you.

I ended up reloading an earlier version and it's fine but it still won't let me download the 233 version. I couldn't figure out how to make an exception yet. It's calling it "Trojan gen 6" I believe, so I'm a little wary of letting it through at this point. I guess I'll just keep the version that's working for now.

Make a exception to a folder and download it to that directly as well as install it to that folder too, i just did that with TRX-2 software witch defender always nukes the moment i download it and it did not complain at all.

 

[AuntEnvy]

Ok VA3, I'll try that route. Thank you.

 

[norcalscan]

BitDefender got it from my laptop last week and nuked it on my behalf. Thanks BitDefender. I had to re-download and install, after adding the exception to the program path in BitDefender. What a mess.

I recall seeing something similar with ESET when I first got into Whistler/EZScan and finding out the false-positive was due to how Whistler compiles their software. Their compiler has the same signature as a known malware, or the known malware uses the same compiler so things start to freak out.

 

[AuntEnvy]

Seems like whistler would do something about this. I seem to recall a few different issues like this as far as virus is concerned...

 

[Ubbe]

It's not the compiler, it is the portion of the code where it is overwriting files that already exists, a function that also a virus infection does to be able to spread the infection, that triggers the virus warning.


/Ubbe