My system is detecting them as Win32/Rundas!Plock
I submitted it to microsoft as "likely not malware" and re-ran the tests on virustotal with the current version for both DwarfMockup-1.2.0.exe & WindowAnnouncement.exe (Both detected by Windows Defender as viruses.)
Links to the virus total analysis here:
https://www.virustotal.com/en/file/6e126556a8560f36d7883d42bb3607b24b733e321cb35f70fe3238956c2e59ea/analysis/1472848159/ (DwarfMockup)
https://www.virustotal.com/en/file/b5a1da567ba815614067b60d8272f4f5062f389045c29b5bfeeb734c980169cd/analysis/1472848618/ (AnnouncementWindow)
If you google around for that particular detection you will see windows defender finding it as a false positive on literally dozens of different programs some by major software companies who tell users "this is why we recommend disabling anti-virus before install, disregard it, microsoft will update it soon, this is normal for new products." Hopefully my submission directly to microsoft will get them around to removing it. Likely this is being detected as a "behaves like a virus" because of how it's hooking another applications code in memory.
Shrug, after reading what it accesses, seeing the majority of scanners don't see it as a virus and it's been detected as a false positive by microsoft for more than 9 months but lacking reports that it actually is a virus... and seeing it not creating files this virus type is known for creating... I'm inclined to disregard it and consider it safe.
Ymmv.
Edit: It might be good for the author/s to contact the scanners that are giving a false positive and see if they can get removed.
Edit: Spoiler tags, because holy huge graphics batman.
Author
Topic: Lazy Newb Pack Trojan? (Read 6408 times)