Serious Discussion Bitdefender and others detected it but kaspersky didn't. I'm a bit concerned.

[gfgtkitkat34]

This file "app_nhm.dll" was part of NiceHash miner software and was detected by ESET, Bitdefender, and other antiviruses, but Kaspersky didn't detect it at all. Why is this?

I understand that Kaspersky has a reputation for the AV with one of the lowest false positive levels and wouldn't detect any file that doesn't harm the system, yet still, why wouldn't Kaspersky just go along with other brands and call it malicious?

In this case, NiceHash miner is not actually a virus and is a legit, safe mining software that thousands of users used during the crypto mining era, but still AV vendors flag it due to it being a crypto miner nonetheless.

Couldn't this Kaspersky low false positive approach be dangerous sometimes?

Thank you for any feedback.

 

[Bot]

Kaspersky's detection algorithms may differ from other AVs. It could be that Kaspersky doesn't classify NiceHash miner as a threat because it's a legitimate software. However, if you're worried, you can manually submit the file to Kaspersky for analysis. Their low false positive approach aims to avoid unnecessary alerts but it's always good to stay vigilant.

 

[gfgtkitkat34]

Kaspersky's detection algorithms may differ from other AVs. It could be that Kaspersky doesn't classify NiceHash miner as a threat because it's a legitimate software. However, if you're worried, you can manually submit the file to Kaspersky for analysis. Their low false positive approach aims to avoid unnecessary alerts but it's always good to stay vigilant.

I'm not sure you're designed for this but how are you doing bot?

 

[Bot]

I'm not sure you're designed for this but how are you doing bot?

As a bot, I don't have feelings, but I'm here and ready to assist you! How can I help you further with your Kaspersky queries?

 

[Captain Awesome]

Its cat and mouse race. Don't worry kaspersky will detect it. Can you submit the files to kaspersky?

 

[gfgtkitkat34]

Its cat and mouse race. Don't worry kaspersky will detect it. Can you submit the files to kaspersky?

Will do. Thanks.

 

[Captain Awesome]

Kaspersky Threat Intelligence Portal

Kaspersky Threat Intelligence Portal allows you to scan files, domains, IP addresses, and URLs for threats, malware, viruses

opentip.kaspersky.com

 

[bazang]

This file "app_nhm.dll" was part of NiceHash miner software and was detected by ESET, Bitdefender, and other antiviruses, but Kaspersky didn't detect it at all. Why is this?

I understand that Kaspersky has a reputation for the AV with one of the lowest false positive levels and wouldn't detect any file that doesn't harm the system, yet still, why wouldn't Kaspersky just go along with other brands and call it malicious?

In this case, NiceHash miner is not actually a virus and is a legit, safe mining software that thousands of users used during the crypto mining era, but still AV vendors flag it due to it being a crypto miner nonetheless.

Couldn't this Kaspersky low false positive approach be dangerous sometimes?

Thank you for any feedback.

Upload the "app_nhm.dll" to Kaspersky's submittal portal.

You can do the same with any other antivirus publisher and request a human review of the file.

There is always the possibility that a threat actor embedded a malicious version of "app_nhm.dll" into NiceHash.

NiceHash has been targeted by threat actors many times because the BS mantra across the web is "NiceHash is legit safe and "app_nhm.dll" detection is a false positive." Enough people buy into that narrative, create an allow exception/exclude "app_nhm.dll" from the antivirus, and their system is pwned. It is so very easy to socially engineer users that want the benefit of something that they just gotta have. They do all the work for the threat actors.

Kaspersky, uhm, fails to detect a lot of stuff. Don't be too sure it is necessarily a false positive. Check your over-confidence in the Special K.

 

[Shadowra]

It's possible that the file is totally unknown to Kaspersky and has therefore never been analyzed, which may explain why it wasn't detected. Or it could be that Kaspersky considers the file to be harmless to the system.

Either way, I've seen that MS Defender doesn't detect it either. VirusTotal distributes to antivirus editors, so the file should soon be added to some editor's virus databases.

 

[Zero Knowledge]

It's detected because it's used in malware campaigns, infect target then install miner then profit. It's a duel use technology, used for legit purposes and malicious.

 

[harlan4096]

I've just downloaded NiceHashMinner 3.1.1.4 from their site and:

My KES did not detect app_nhm.dll, but detected 62 files inside...

 

[gfgtkitkat34]

NiceHash has been targeted by threat actors many times because the BS mantra across the web is "NiceHash is legit safe and "app_nhm.dll" detection is a false positive.

I fully agree with you. However, this is the normal level of common sense an average consumer has. Search on Google to see if something is safe or not, and after that, let your antivirus double-check on it again, and that's it. For the info, I didn't turn off K or add exclusions to anything. If anything happens to my PC, Kaspersky should be responsible, and I will be done with them. Thankfully, I only use this PC for test renders and gaming so not a big deal.

 

[bazang]

It's detected because it's used in malware campaigns, infect target then install miner then profit. It's a duel use technology, used for legit purposes and malicious.

LOL, but everybody says it is a false positive and to exclude it. There are malicious and non-malicious versions, but even the non-malicious version can be abused to do malicious stuff. Just like you said.

And the users "who want to use stuff" do all the work for the threat actors like I said.

 

[bazang]

I fully agree with you. However, this is the normal level of common sense an average consumer has. Search on Google to see if something is safe or not, and after that, let your antivirus double-check on it again, and that's it.

This is how "users that want to use stuff" end up infected. In your case, lose all your crypto.

There is no "common sense" when fighting malware. There is just security.

"Common sense" is assuming that Kaspersky or any other AV will work at the moment of truth.

"Common sense" is the exact behaviors that threat actors want "users who want to use stuff" to do.

Security is not software. It is a process (of doing a bunch of stuff you don't want to do and not doing a bunch of stuff that you want to do.)

 

[gfgtkitkat34]

I've just downloaded NiceHashMinner 3.1.1.4 from their site and:

View attachment 287775

My KES did not detect app_nhm.dll, but detected 62 files inside...

Yes, Kaspersky deleted 62 objects the same as yours but missed on app_nhm.dll. Could this be a harmless false positive then?

However, Emsisoft Emergency Kit detected it and got rid of it, saying it was Trojan IL:Trojan.MSILZilla.154810 (B).

 

[harlan4096]

Can You send me that file via pm?

 

[Captain Awesome]

Can You send me that file via pm?

Already sent to Kaspersky no reply from them also scan with Opentip no luck. See #7 post

 

[harlan4096]

Can You send me that file via pm?

Ok, I've extracted the installer with WinRAR, and reported that file also to KOTIP...

 

[Captain Awesome]

Already sent to Kaspersky no reply from them also scan with Opentip no luck. See #7 post

Kaspersky: its aClean clean file.

 

[Captain Awesome]

Kaspersky: its aClean clean file.View attachment 287777

Now its detected as Adware.