Kill.com

I have been dealing with the kill.com problem for a while and mine problem is even worse. Norton Security Suite that Comcast gives free to customers is quarantining Kill.com and the entire Aurora Sequencer and Scheduler software. If I try to open either, there is no file to open with. I have to reopen the original download file that fixes Aurora then open Aurora Sequencer or Scheduler immediately after. Norton thinks its so bad I can't exclude aurora. Hope not to deal with this next year. Adding this to my other problems have been frustrating.

I'm just glad this was caught now instead of December; this is the type of thing that usually pops up around then and makes a support nightmare (does anyone happen to remember Windows Update replacing the FTDI drivers right in the middle of the 2009 season?)

Michael

I don't know the process with AVG.  With Avast I had to restore it from the virus chest, then temporarily shut down protection, then generate the MD5 hash, and then restart protection.

I submitted a false positive with Avast.  I encourage you to do the same with AVG. 

For performance reasons it is unlikely that any antivirus actually looks at every byte in a file.  While they don't reveal their secrets, it is probable that they look at a handful of bytes and the total file size to figure out if it is a threat or not.  This Aurora file just happens to match the pattern when it isn't a threat.

Interestingly, I can get the file to pass Antivirus testing if I comment out the lines which shut down the DMX-over-dongle server (the 2009-2011 DMX patch).

Michael


Edited by LightsOnLogan - 12 Sep 2012 at 3:45pm

Avast started yanking killcom.exe off my development systems today too, so I guess I just today got the definitions update that thinks it is bad.  It gave no warning/notice or anything... one minute the file is there, then the next it is gone without any evidence as to what happened.  No log was generated in the Avast GUI either.  I had to go looking for it in the chest to find where it went.

If you have one then you can use your favorite MD5 checksum generator to check yours, or you can download one (this one is easy to use: http://www.colonywest.us/digestit/ )

There are two versions of the file for Aurora, both created in 2009.  The one with the July date should have a checksum of e7483276d245eb5fbd2d5dd0983258eb.  The one with a December date has a checksum of 246b990f9acff3958f6a551889ae2339. 

I just rebuilt from source and Avast immediately yanked the file created from source as soon as the compiler was done writing it to disk.  False positive?

Michael


Edited by LightsOnLogan - 12 Sep 2012 at 2:36pm

I'm not getting it on avast here. I'll put together a checksum for the file tomorrow to make sure neither of yours have become infected.