Samsung Magician Update trojaner

[andy0403]

Today I got the message from Samsung magician to update to version 7.0.1 which I did. 1 Minute later kaspersky send me this:

---

PDM:Trojan.Win32.Generic    Trojaner    Hoch    Genau    samsung_magician_installer.exe    samsung_magician_installer.exe c:\programdata\samsung\samsung magician\site link

---

is this a false positive or was it a real trojan?

Kaspersky did delete it, I did another scan, everything seems to be clean.

Win10 /home 21h2

Thanks, Andy

[Leorik]

+1 абсолютно та же проблема

[Guest #37]

Hi,

Upload the file here: https://opentip.kaspersky.com/

Click Submit to re-analyze

Regards

[Rfm639]

I’ve just had the exact same experience. After installing the update from within the Samsung magician app to 7.0.1 my system become slow and unresponsive, then Kaspersky alerted me of an infection. Same code: PDM:Trojan.Win32.Generic. Did an advanced disinfection process, all seems fine.

 

I am not confident enough to reconnect the PC to the internet, will probably just nuke the drives and start again.

[Guest #37]

Hi,

I download Samsung Magician Software v7.0.1(Samsung website) and uploaded to opentip: 

 

Waiting for Kaspersky Technician reply.

Regards

[Romolo]

Hi,

Identical problem, after updating Samsung Magician KIS identifies virus "PDM:Trojan.Win32.Generic".
The executable file Samsung_Magician_installer.exe is clean but after installation KIS identifies the Trojan warning on the PC.

Test run on 4 PCs with the same problem "PDM:Trojan.Win32.Generic".

[Guest #37]

Hi,

Yes, I reported to Kaspersky, waiting for reply.

Regards

[Rfm639]

This is the exact file Kaspersky quarantined, I retrieved it from quarantine and uploaded it just now.

 

https://opentip.kaspersky.com/B82F3FEA603196A8979F5FF9097879DCBC8EB425F2F353696F75B9F11FF71C53/

[Imaginos]

The trojan (PDM:Trojan.Win32.Generic) was in C:\ProgramData\Samsung\Samsung Magician\Site Link.

Kaspersky carried out a rollback but I can’t figure out whch version of Samsung Magicain is now installed.

[Guest #37]

Hi,

Kaspersky reply:

Hello,

This is a false positive of the PDM module.
Detection will disappear within 24 hours.
To fully correct all defects related to future versions of the software, the System Watcher logs and the anti-virus product traces are required.
1. Here are the instructions for how to obtain System Watcher logs:
https://support.kaspersky.com/15544
2. We recommend that you disconnect from the Internet (or disable automatic updates of anti-virus databases), enable tracing as instructed below, and try to reproduce the issue once again.
Here are the instructions for how to obtain trace logs:
http://support.kaspersky.com/12797?utm_source=virus_lab_notifications&utm_medium=email&utm_campaign=virus_lab
For the web pages, also please send us an .mht archive of the page. It's available in the Internet Explorer browser from the context menu "Save As" on the page.
Our support team will provide more details if you have troubles with this. To get assistance please create a Support request using our portals:
* for home products:  https://support.kaspersky.com/b2c#contacts
* for corporate products: https://companyaccount.kaspersky.com
If you have problems with the form, you can contact our technical support by phone (according to your location):
* for home products: https://support.kaspersky.com/b2c#contacts
* for corporate products: https://support.kaspersky.com/b2b#contacts
Prior to sending your request we strongly recommend you to check our Kaspersky Lab official forum: https://community.kaspersky.com/ as it may have the information you are looking for.
Thank you for your help.

Best regards,

Kaspersky Lab

Regards

[andy0403]

So it’s actually no problem at all?

Samsung Magician version was 7.0.0 and the update went in to 7.0.1

It’s now installed.

Anything else I have to do?

[Guest #37]

Hi,

If you can, please send traces and system watcher logs of the installation of the new version to Kaspersky:

To fully correct all defects related to future versions of the software, the System Watcher logs and the anti-virus product traces are required.
1. Here are the instructions for how to obtain System Watcher logs:
https://support.kaspersky.com/15544
2. We recommend that you disconnect from the Internet (or disable automatic updates of anti-virus databases), enable tracing as instructed below, and try to reproduce the issue once again.
Here are the instructions for how to obtain trace logs:
http://support.kaspersky.com/12797?utm_source=virus_lab_notifications&utm_medium=email&utm_campaign=virus_lab

Our support team will provide more details if you have troubles with this. To get assistance please create a Support request using our portals:

* for home products:  https://support.kaspersky.com/b2c#contacts

Regards

[andy0403]

I did pack it but last change in this folder was 21-04-2021, nothing about todays problem.

[Theo1968]

I had exactly same problem.

The installer is gone, but the update was succesfully implemented

[Guest #37]

Hi,

I tried yesterday night at home, upgraded samsung magician to the last version 7.01 and KTS didn´t detect anything now.

I think is resolved and not needed to do anything more.

Regards