[Solved] Kaspersky Pure 3.0 flags wintoolkit a malware

[andrum99]

The unfortunate thing is the broadband is actually my brother's since I share a flat with him. With any luck this will all resolve itself soon...

[Kelsenellenelvian]

Wintoolkit does check for updates for itself on start but can be run offline also to demonstrate no issue with it downloading files.

 

The update check can also be disabled via the options menu.

[Kelsenellenelvian]

Since you have retracted your statement I can also cancel the claim.

[andrum99]

I will send my logs to Kaspersky tomorrow to have this false positive in their product corrected.

[Kelsenellenelvian]

I have sent a request for the complaint ticket to your isp to be cancelled now that your comments on your blog are no longer there.

[andrum99]

Just a thought - if you are going to advise folk to disable their AV it might be worth recommending disconnecting from the internet while they have it disabled. That recommendation troubled me somewhat,

[andrum99]

Many thanks for doing that. YOu will have a full apology from me once wireshark gives me a clean log. I want to do this the right way this time ;-)

[Kelsenellenelvian]

I'll suggest that to the author. It is a common recommendation for applications like this though (nLite, vLite, Xplite and so-on) as av programs can really slow the process down and occasionally screw up the source your trying to modify.

[Kelsenellenelvian]

i'm going to be away for 3-4 hours I'm eager to read your results.

[andrum99]

I began with a Windows 7 retail ISO image and integrated all security updates downloaded my Windows Updates Downloader. There is no traffic of any concern in my Wireshark capture. I did some of the run with my VM's antivirus disabled and it all looked OK. It seemed a lot faster in the VM - perhaps this is due to my using different antivirus.

 

Total time for the integration run was 50mins 5 secs. I did not attempt to run Windows Updates Downloader at any point - I simply used files that it downloaded previously. My next step is to run Windows Updates Downloader in a VM with Kaspersky Pure 3.0, then WinToolkit in a VM with Kaspersky Pure 3.0 to see what happens.

 

I found no evidence that there is anything untoward about WinToolkit. I am satisfied that WinToolkit contains nothing untoward, and is safe to use. I have therefore issued a full retraction on my website, and I apologise unreservedly for the problems I have caused here this evening.

 

Andrew Pattison.

[Kelsenellenelvian]

Thank you for your candor and now that is over welcome to wincert please feel free to visit here again.

[andrum99]

I have put a request on the Kaspersky forums for an explanation as to why Pure 3.0 is red flagging the installer version of WinToolkit. I suspect that it doesn't like the crapware that the installer contains, since the portable version is not getting red flagged.