Jump to content

Leaderboard


Popular Content

Showing content with the highest reputation since 03/20/2018 in all areas

  1. 2 points
    I am running Windows 7 Pro on an older desk top and during the last few days have been getting a Virus detected and quarantined message on virtually every application that I use. I have been using some of these sights for 10 plus years and never had this issue previously. It persists even when I switch from Firefox to Chrome. I just ran a full scan of the entire computer and get reports of no virus found and have verified that the latest update is installed (as of 2/2/19). When I go to manually initialize Immunet, I see a note that the computer has never been scanned and is not secure even when I have just run a full scan. A typical warning is that f_0001f3 has been detected as Clam.Txt.Trojan.Generic-6840302-0. Quarantine was successful. I even got a message that Firefox Installer was a Trojan. This is very annoying and I would like some suggestions to resolve this issue. Nelson
  2. 2 points
    confirmed, is defiantly a Clam false positive. Thanks to everyone who reported this. we're reprod it internally and are working on a fix. In the mean time, if you turn off the clam AV engine in Immunet's settings that'll prevent the constant FP notifications and still keep your computer protected with the immunet cloud engine. We'll notify the thread to turn clam back on as soon as the fp is fixed.
  3. 2 points
    it might be an issue with a signature, I am looking into it.
  4. 2 points
    it looks like you are using clamav, not immunet. ClamAV gives you the ability to run commands- immunet does not. As far as multi-threaded scans in ClamAV, you could just do a clamd scan with multithreaded- should work
  5. 2 points
    Why not brother.. You can download Avast offline installer from here and Know how to uninstall avast step by step here.. The step by step guide also has a link to the avast removal tool
  6. 1 point
    You can try to upload the two files on Virustotal and check the results from different AVs https://www.virustotal.com/#/home/upload
  7. 1 point
    trying to download ccleaner554 and immunet blocks it and says its a trojan but not always the same!
  8. 1 point
    Thank you very much for reporting this Jon. I've successfully reproduced it, and at this point my only advice is to steer clear of win 10 1809. as far as I can MS pulled it after release due to driver incompatibilities and potentially deleting user data when upgrading from previous versions. I was able to obtain a 1809 iso through MSDN and it ended up bootlooping during install of both home& pro win 10 versions (installing to vmware workstation). I had to use a workaround just to complete the OS install: https://luyentap.blogspot.com/2017/10/windows-installation-cannot-proceed.html. After that I was able to install Immunet and repro your bug.
  9. 1 point
    Six months later and we're still on the Windows 7 era GUI
  10. 1 point
    We cannot force upgrade ANY Immunet version that is 5.x.x and below, so you need to manually upgrade to the latest version of Immunet 6.2.4. What happens if you do not upgrade before the decommission? You will need to uninstall and reinstall the software once the old infrastructure is decommissioned. We urge everyone on a version prior to 6.2.0 to upgrade Immediately. If you have any questions or concerns, please contact us via the support forums or posting below. Those that do not upgrade will cease to receive coverage from the product as we are doing a force cut over of the free antivirus system on the cloud side. March 4th is the OFFICIAL date when all coverage for ANY version of Immunet below 6.2.4 will stop receiving coverage. PLEASE upgrade ASAP so you do not have any interruption of service.
  11. 1 point
    For any user that experiences what they think may be a False Positive quarantine response we do encourage the use of our official False Positive reporting site at this link. http://www.immunet.com/false_positive Regards, Ritchie...
  12. 1 point
    I'm receiving the same message when loading Gmail in firefox flagging a cache file as "Txt.Trojan.Generic-6840302-0". I also have a number of anti-spam anti tracking and security plugins installed. It's possible one of them is doing something Immunet doesn't like. ABP, Ghostery, uBlock Origin, https everywhere, canvas defender, privacy badger, firefox multi-account containers and lastpass. I uploaded the cache sample to virus total. The ClamAV engine was the only one to flag this as a trojan. The content is a compressed GZ stream with the following code: this.A2A=this.A2A||{};(function(_){var window=this; try{ var aa,ba,ca,da,ea,fa,ha,ia,ja,ka,la,ma,na,ua,va,wa,xa,ya,za,Ba,Da,Ea,Ia,p,Ja,Ka,Na,Oa,Pa,Qa,Ra,Sa,Ta,Va,Wa,eb,fb,gb,hb,ib,jb,kb,mb,lb,nb,ob,pb,q,t,v,qb,rb,sb,tb,ub,vb,wb,yb,zb,Cb,Ab,Bb,Db,Eb,Fb,x,z;aa=function(a){for(var b=a.length;0<=--b;)a=0};ba=function(a,b,c,d,e){this.te=a;this.Jf=b;this.If=c;this.Ff=d;this.lg=e;this.Nd=a&&a.length};ca=function(a,b){this.zd=a;this.xb=0;this.Wa=b};da=function(a,b){a.T[a.B++]=b&255;a.T[a.B++]=b>>>8&2 Source: https://www.virustotal.com/en/file/6570a85c33d467f10e52bddc31575c4329ca1a6ae9641c4321690a8ae65e41c5/analysis/1549184011/ I've submitted it to clamAV as a false positive.
  13. 1 point
    Richie is correct - the internet connection icon is a standard windows thing. the Bing image search told your browser to show an image from neilrosenthl.com and your browser went to grab it from 104.27.175.64. According to https://dnslytics.com/ip/104.27.175.64 that ip is hosting 290 domains/websites. likely one of them at one point was hosting something malicious. Though currently neilrosental.com appears to be safe. Looks like a false positive to me. Sorry, our bad on that one. I do have one concern here though. It's common to first notice the internet connection icon after having a random router/modem reboot. I The internet stops working, so you go to your network connections to check your ip/network status and while your poking around the internet connection icon appears out of nowhere when the router/modem comes back online. There are lots of good reasons for a router to reboot itself, but it should be noted that not all vpn connections can survive a router reboot. Some can, some will notify you the vpn closed unexpectedly, and some will just fail silently and your internet activity will automatically re-route over non encrypted public internet. Thanks, RobT
  14. 1 point
    Immunet is undergoing major changes. For a long time, the AMP infrastructure and Immunet infrastructure have been the same. But, we are changing that now to separate the customers of AMP and Immunet into their own cloud infrastructures. As of right now, any Immunet user who is not on version 6.2.0 is on the old infrastructure and will need to upgrade to the latest version as soon as possible. We plan on decommissioning the old infrastructure (that means any versions prior to 6.2.0) on Feb. 4, 2019. What does this mean? This means that all users who aren’t already, need to be on version 6.2.0. If you are on 6.2.0 now, you will not see any changes and do not need to worry. If you are on the older version, you need to upgrade immediately. If you do not upgrade before Feb. 4, you may experience service interruptions and may not be able to upgrade Immunet or receive protection. What happens if you do not upgrade before the decommission? You will need to uninstall and reinstall the software once the old infrastructure is decommissioned. We urge everyone on a version prior to 6.2.0 to upgrade Immediately. If you have any questions or concerns, please contact us via the support forums or posting below.
  15. 1 point
    The bios bug Wookiee mentions is usually found with brand name manufactured computers, ie Dell / EMachines/etc. and otherwise we have seen installation issues where users have special characters characters in their Windows user names. e.g ' " , <> ]!@$%^&*()_ Any chance either of those apply?
  16. 1 point
    What is your Immunet version? It should look like this: The copy fail should be fixed in the later versions of Immunet. Though, sometimes it happens because it is not handling a odd character in the BIOs name such as a tilde key, or something similar. You could attempt to boot into safemode and try that, but if it is the bios name triggering the copyfail, then that wouldn't work without a bios change.
  17. 1 point
    Hello again. 64 bit protection in 6.2.4?? Thanks!
  18. 1 point
    Yeah, Rich is correct- Immunet doesn't out-source or do anything like that.
  19. 1 point
    Immunet doesn't use any out-sourced URL connections. Instead Immunet Protect uses it's own dedicated servers for the ETHOS & SPERO cloud look-ups and for the ClamAV module's definition signature updates. So the answer to your question is no, these URL's are not related to Immunet.
  20. 1 point
    Apologies for resurrecting a thread after a few weeks, but I think I've had this same issue with another program, and it's not a signature detection. Your mp3 batch tag operation triggered Immunet's rudimentary ransomware protection, so the operation was stopped and the program terminated; however the lack of a signature detection resulted in the program being blocked but not quarantined. It makes sense, if you think about it. What does ransomware do? It locates any document files it can find, and goes through them sequentially. One by one, each file is opened, changes are written, the file is closed, and the next file is opened... What did your mp3 tagging tool do? Go through a folder of data files (mp3s), and one by one, open each file, write a change to it, close it and progress to the next! So in summary, the program's behaviour was blocked, but nothing was probably quarantined.
  21. 1 point
    Hello pufig, first of all it is very, very important to make sure that what you're attempting to restore is a False Positive and not actually genuine malware. One great way to do this is to check the file with VirusTotal.com's database first. https://www.virustotal.com/#/home/upload After you are "absolutely certain" that the file is not malicious you can click on the History tab -> to the right of View By click on the little downward pointing arrow -> this will open a little drop down menu and click on Quarantined File History -> find the file in question from the list, click on it and choose the "Restore" option. This automatically moves the file from Quarantine to the Exclusion list where it will no longer be scanned.
  22. 1 point
  23. 1 point
    Hi Rich, I'm sorry to say that Windows Server 2019 is not a supported platform at this time however Win 10 is supported. Immunet does have an "enterprise version" that I believe will work with Windows Server 2019 called AMP for Endpoints (AMP is an acronym for Advanced Malware Protection). It's not free but the price is reasonable and actually negotiable depending on the length of your license that you choose and the number of endpoints to be protected. Plus you get much better malware/intrusion protection compared to Immunet in a server environment. So take a look to see it AMP for Endpoints better meets your needs. https://www.cisco.com/c/en/us/products/security/amp-for-endpoints/index.html Cheers, Ritchie...
  24. 1 point
    Yes, it will have the same level of protection
  25. 1 point
    Immunet is undergoing major changes. For a long time, the AMP infrastructure and Immunet infrastructure have been the same. But, we are changing that now to separate the customers of AMP and Immunet into their own cloud infrastructures. As of right now, any Immunet user who is not on version 6.2.0 is on the old infrastructure and will need to upgrade to the latest version as soon as possible. We plan on decommissioning the old infrastructure (that means any versions prior to 6.2.0) on Feb. 4, 2019. What does this mean? This means that all users who aren’t already, need to be on version 6.2.0. If you are on 6.2.0 now, you will not see any changes and do not need to worry. If you are on the older version, you need to upgrade immediately. If you do not upgrade before Feb. 4, you may experience service interruptions and may not be able to upgrade Immunet or receive protection. What happens if you do not upgrade before the decommission? You will need to uninstall and reinstall the software once the old infrastructure is decommissioned. We urge everyone on a version prior to 6.2.0 to upgrade Immediately. If you have any questions or concerns, please contact us via the support forums or posting below.
  26. 1 point
    I just renamed an album's worth of files using the program, and Immunet didn't get triggered, so the exceptions must be working like they should.
  27. 1 point
    Hi all, I noticed a thread that's been moved to the FAQ section (therefore I can't reply on it) regarding someone wanting to use the CLI to restart the immunet service. The solution offered was to use good-old "net stop" / "net start". This requires you to know the exact name of the service (obviously). The problem is that over the years I've used Immunet, the service name has changed occasionally. It has been known as "ImmunetProtect", "Immunet", "Immunet[version.number]", etc. If you want a generic way of always reliably starting and stopping the service from a terminal, you need something that just needs to know that the service you're after is Immunet, but doesn't care about the exact name. The solution? The following "generic" commands: Stop any service that's got the word "Immunet" in its name: wmic service where "name like 'Immunet%'" call stopservice Start any service that's got the word "Immunet" in its name: wmic service where "name like 'Immunet%'" call startservice Please note that these work directly on the commandline. If you wish to execute these from within a batch file, you need to replace 'Immunet%' with 'Immunet%%' (add a second %), or it won't work. These two commands should allow you to always be able to restart the service, regardless of if the developers change its name slightly from version to version. I use these in a .bat file that adds the latest Sanesecurity and Securiteinfo ClamAV signatures to Immunet (amazing detection rate), but I will wait until the "ask me" bug in 6.2 is fixed before posting the source here, as these signatures cause many false positives.
  28. 1 point
    You can open up command prompt as admin and run a "net stop <servicename>" then "net start <servicename> you can do a "net start" to see what is currently running. You can also just reboot and it should start the service again. Not sure why you got that error, maybe lack of internet connection or something like that.
  29. 1 point
    Okay.. Thank you so much for your help Rekhathakur..
  30. 1 point
    Thanks for some guidence Rekha,, Can you also provide me the links to these tools please ?
  31. 1 point
    Hi claudiot, please click on this link to a thread I just posted to a similar Support topic that will show you how to avoid these false positives by creating a custom exception rule with Win 10 Defender. http://support.immunet.com/topic/3706-trojandownloader-jsnemucod/
  32. 1 point
    It was never not safe. You can upgrade. Cloud issues that reported '0 people protected' is fixed.
  33. 1 point
    The cloud stats message, shouldn't have anything to do with you having the latest signatures. It should not leave you unprotected. You will need to make sure you are running the same signature set on both versions.
  34. 1 point
    If you can obtain the files, I can do a comparison, but these would all be signature based. Signatures are what 'find' the malware / ransomware etc. The signatures aren't going to change version by version from 6.0.8 to 6.2, unless the malware itself is changed (or there was an issue with the signature in the first place, to which we push updated signatures out). I am not disbelieving you, But without knowing the exact file, the exact signature- this is a lot of 'he said', 'she said'. There was a few issues with some signatures about a week ago, in regards to detecting certain files, as malicious when they weren't, which were corrected. I would need the malware file(s), to conduct any test to see the following: 1) IF something has changed between versions (signature versions or software versions) 2) what signature(s) are being detected Though, nothing should of changed (other than the signatures possibly and I don't know that without the sample malware file(s)).
  35. 1 point
    We don't have anything to decrypt your data if a ransomware attack happens. We look for more malware and things like that. You might want to turn 'blocking' on if it isn't already in the immunet settings though. That could help. There should be ransomware specific softwares that could have key(s). The .krab file is a grancrab, which signatures DO exist for detecting but Immunet and clamav does NOT decrypt it. Below is a NON CISCO tool, use at your own risk. https://www.nomoreransom.org/uploads/GANDCRAB RANSOMWARE DECRYPTION TOOL.pdf
  36. 1 point
    Hello all, We are happy to announce a new release of Immunet: Version 6.2.0! This latest version of Immunet provides the same great protection against malware and viruses as before, but also includes Malicious Activity Protection (MAP) engine for detecting ransomware, System process protection detection notifications, Connector UI improvement, Performance improvements, Support for Windows Server 2016 and other bug fixes. As always, you can get the new installer at https://www.immunet.com. We strongly recommend existing Immunet user to upgrade to v6.2.0 and start taking advantage of new features and improvements. If you are running an older version of Immunet, you should be able to upgrade via the 'Update Now' button in the UI. If you don't see the update in your UI, you can always download the latest installer from https://www.immunet.com and execute it to get the upgrade. If you do encounter problems with the new version of Immunet Protect, please let us know via forums at http://support.immunet.com Thank you for your continued support! The Immunet Protect Team
  37. 1 point
    We are aware of the issue and should be releasing a fix 'soon'
  38. 1 point
    I will talk to the dev's about this issue. (it's the first I have heard of it) But I am sure they have been made aware, either way- I created a bug ticket for it and will do some testing etc.
  39. 1 point
    Do you have enough space for the update? Internet connection is on? Not going through a proxy? Can you send me a support file with debugging enabled, and try to update again. i'll message you the details
  40. 1 point
    Hi Art, what version of Win 10 are you using? In the mean time here's a few things you can look into. Make sure there isn't a program you use that may interfere with Immunet's installation such as your firewall of choice, another AV, sandboxing software, behavior blocker, etc... Since Immunet uses a bootstrapper installer an "uninterrupted internet connection" is also required when the files are being downloaded & during installation. You could also try a new installer package in case the one you downloaded got corrupted some how. Here's a link to download the newest installer. https://download.immunet.com/binaries/immunet/bin/ImmunetSetup.exe Best wishes, Ritchie...
  41. 1 point
    Every software has bugs, the point of reporting these issues is so that we can fix them. Immunet bugs go through ME now, I have only been on this project for a short time. I am trying to FIX any and all problems reported. Though, this will obviously take time to find WHY something is not working right. Now, if you want to enable debugging, and wait for the scheduled scan to not kick off again- then generate a support dump, and send it in- I can look at fixing it.
  42. 1 point
    This was fixed with the signature.
  43. 1 point
    Good morning, This morning all the Windows Based Machines (Windows 10 and Windows Server 2012 and Windows 2008 R2) in our office running Immunet Anti Virus have this message: AppXDeploymentExtensions.onecore.dll has been detected as W32.45D0D4390-100.SBX.TG Quarantine failed. Any suggestions as I am not finding anything on the web about this other than AppXDeploymentExtensions.onecore.dll is a Windows Dymanic link library???? Any help appreciated! Thanks
  44. 1 point
  45. 1 point
    Ritchie, Thank you for responding so promptly! I'm satisfied with your response as it seems to be a well-established one to these types of questions in the forum. As a huge fan of you and your teams' work, I will continue to hope that this type of functionality lands itself onto your roadmap somehow. Thanks again for taking the time this weekend. I hope you have a wonderful coming week! Respectfully, Nadmin
  46. 1 point
    Hi Valnat, Immunet & Amp for Endpoints do share the ETHOS, SPERO and the ClamAV engines & sigs. AMP also has the TETRA module that was only available to the Plus (paid) version of Immunet when it was still being supported. TETRA has the ability to detect threats that other AV engines may have trouble with. For instance, encrypted rootkits to name just one. I hope that answered your question. Regards, Ritchie...
  47. 1 point
    Hey everyone! Yes, more can be done with the overall design, and I can bring it up to the rest of the developers for a potential future release. @lucasLKs, you must know I am a sucker for anything dark themed because I dislike bright, bright colors in software. I actually really dig the design, though- I would probably tweak somethings. personally- interfaces are important for people to understand and use, and command-line only is more outdated than anything ( depending on who's actually using it, skill level, etc). I am simply saying, you all ARE being heard, and I will bring it up to the rest of the team.
  48. 1 point
    Hello everyone, I see a lot of future in this software, its interface is destined to "the end", compared to other interfaces today ... But instead of just talking, I made a new design for Immunet AntiVirus .. .I only did the basic part, in case I get you back, I can go back to work on the interface and finish for a new look to the software. Here are the images: I look forward to the feedback from the developers, and also from the community. Att: Lucas Lks
×
×
  • Create New...