tr/dropper.gen5

[AnneB]

I regularly scan my computer for viruses and problems.  Recently, I’ve discovered a known “Malware” file called tr/Dropper.Gen5.  This file has embedded itself in my Kaspersky Total Security subdirectory attached to the program file “AVP.EXE”.  I am using a program called “Restoro” that reports this.   Kaspersky does NOT see the file nor report it.  Restoro sees the file and says it will be removed after fixing and a reboot, but after following their recommended procedures  the file “tr/dropper.gen5” remains.   I cannot find the file/program manually, hence I cannot remove it manually without damaging or removing my precious Kaspersky.   Any suggestions would be greatly welcome. I am at my wits end as I believe this malware to be particularly malicious. I have enclosed a screen shot of the message I keep receiving.

[harlan4096]

Welcome to Kaspersky Community.

 

That tool is flagging Kaspersky service as malware ?‍♂️?‍♂️ seriously???

 

That Restoro app seems a false optimizer, I would urgently and directly uninstall it from the system!

[AnneB]

Thank you for your advice harlan 4046, but it was a paid for programme. However, if I hear another say this - I will do as you advise and ask for a refund. You were very prompt - I am grateful.

[Flood and Flood's wife]

19 minutes ago, AnneB said:

Thank you for your advice harlan4046, but it was a paid for programme. However, if I hear another say this - I will do as you advise and ask for a refund. You were very prompt - I am grateful.

Hello @AnneB, 

Thank you for posting back!

• The issue has been raised previously, Malware tr/Dropper.Gen5, by Mtnbikersd108, the advice from @richbuff, who was a Moderator at that time was: Please inform “Restoro”, “SpyHunter”, and “RegHunter” of their false positive. Also, please contact Tech Support if you think it is not a false positive. 
• IF you do decide to contact Support, on the support page, select either Chat or Emai, then fill in Malware, Detected threat appears over and over again; Support may request logs, traces & other data; they will guide you. 

Please share the outcome with the Community, when it's available? 

Thank you?
Flood?+?

Edited November 1, 2022 by Flood and Flood's wife

[Igor Kurzin]

Hi @AnneB, 

Restoro has been detecting Kaspersky for a long time and they are not fixing it which means to me they are not playing a fair game.

There is not much we (technical support) can do about it, other than recommend not to use Restoro. 

[AnneB]

Thank you for your reply Igor from Kaspersky. I would firstly like to try the advice given by Flood & Flood's wife before I dislocate Restoro because for all other issues, it has been pretty good, but this particular repetitive warning does worry me. 

[AnneB]

I have written to Restoro informing them of the problem and that I have also been in touch with Kaspersky. I am now awaiting a reply and if satisfactory - I will post that on here.

Regards,

Anne B

[Flood and Flood's wife]

7 hours ago, AnneB said:

I have written to Restoro informing them of the problem and that I have also been in touch with Kaspersky. I am now awaiting a reply and if satisfactory - I will post that on here.

Excellent @AnneB, 

Thank you for your proactive action & for keeping the Community informed?

 

[AnneB]

I have received a reply from Restoro, I don't know if it will be of any help to anyone else, but I have attached the body of the email here. They are going to delve into the problem with the information I have sent and have asked me that while they are investigating - not to scan anything with Restoro for the time being.

Thank you for contacting Restoro!

For faster and better results, you can also talk to us via 24/7 Live Support, simply click on the chat link below

We understand that you are still getting the malware notification from the program. Rest assured we are here to help.

As the malware deleted somehow embedded itself into the Kaspersky program itself, we'll report this to our Developers Team for them to check it further. We'll need to gather logs from your computer under Restoro folder.

 1.        Navigate to: C:\Program Files\Restoro and look for TechSupportApp.exe.

2.        Right-click on TechSupportApp.exe then select "Run as Administrator".

3.        Once the CMD window closes, make sure you have the following file on your desktop: “Tech Support Data.zip”.

4.        On some cases, these supporting log files were needed: (a.) restoro_downloader; (b.)restoro_repair can be found in Temp folder (Open run and type: %temp%)

 Once you have procured the file, please send us the copy by uploading it at https://gofile.io/welcomet then send us the download link.

 If you have any further inquiries, you can contact us anytime.

 You may also visit www.Restoro.com for more information. We are available 24/7.

 Thanks for contacting Restoro, have a great day!
Regards

Tina C

Support Team Leader

Restoro Service & Support

Ticket Details

[FilT]

Hi @AnneB, I have exactly the same issue, did Restoro replied back after the information you have sent? How you end up solving this? Thanks in advance. 

Edited February 2, 2023 by FilT

[Igor Kurzin]

Hi @FilT, 

I will dare to make an assumption that the Support Team Leader from Restoro for sure knows that Kaspersky is detected as malware for years, and definitely it is not

On 11/5/2022 at 3:24 PM, AnneB said:

malware deleted somehow embedded itself into the Kaspersky program itself

Kaspersky application is well protected by Self-Defense and other technologies.

[Kasperov]

I think its harmless to add here my experience over the years with some applications like pc clean up, registry cleaners, backup programs..., that if after installation they added multiple background processes, startup entries & icons in system tray, to me its the sign of immediate uninstall. All I want is -once a while- clean up or backup, not every moment resource eating & pop up messages. Also a user should be very careful with registry cleaner, deleting wrong registry entries equals to applications errors or system crash, generally registry cleaner is not recommended by many including Microsoft.