trojan-spy.win32.keylogger

[Jose]

I just bought a course from a well-known course-providing website, and this specific course has been bought over 100 thousand times with a 4.8 or 4.9 rating out of 5 by tens of thousands. Part of this course was a zip file that had some resources that were to be used during the course.

However, Kaspersky has detected some kind of Trojan in these files. I contacted the course provider and he assured me that it was just because the zip contained a file of very old software that the antivirus detected as a threat and no need to worry and the file was completely safe. I clicked on "Resolve" but it took forever then showed an error and after running another scan the 2 files were still there. So I don't know what to do and if the files are actually clean or not.

Windows version: Windows 11, Version: 23H2, Build: 22631.2715

Name of Kaspersky: Kaspersky free, Version number: 21.15.8.493

Database release: Today, 2:44 PM

Edited November 25, 2023 by Jose

[Jose]

[Berny]

@Jose Welcome.

Please submit the object on  https://opentip.kaspersky.com  and ask for Reanalyze.

[Jose]

13 minutes ago, Berny said:

@Jose Welcome.

Please submit the object on  https://opentip.kaspersky.com  and ask for Reanalyze.

Thanks for your reply. The zip file is still zipped, is it safe to unzip it so I can upload the object? The zip exceeds the file limit on the link you have provided so I need to upload just the specific file. So please let me know if I should extract the zip file to upload the object or if is there another solution. Thanks.

[Berny]

@Jose You are welcome.

Unzip without execute is no problem, anyway Kaspersky is blocking infected/suspicious objects. 

 

[Jose]

57 minutes ago, Berny said:

@Jose You are welcome.

Unzip without execute is no problem, anyway Kaspersky is blocking infected/suspicious objects. 

 

Welp, the moment I unzipped Kaspersky deleted them. I don't know what to do, as if these files turn out to be actually clean then I do need them.

[harlan4096]

To send to those files to KOTIP You have to pause temporally K. protection, extract the files, send one by one, and then re-enable K. protection.

 

Follow these steps to report the possible false positive in those files:

 

 

[Jose]

I have uploaded both files and requested "Reanalyze" as you have told me. But I am not sure what else to do? Do I wait for something? 

[harlan4096]

When reanalyze and get the verdict, the Submit:

 

 

And type Your email address, and paste below the link of this thread.

[Jose]

Thank you so much. I got the email confirming it was a false report and indeed it's no longer detected as a threat. 

Edited November 28, 2023 by Jose