Kaspersky is reporting malware in the Roon installer (even when whitelisted)

Support
1

I noticed that an earlier topic existed. Situation:

  • My Roon environment was corrupted
  • I uninstalled Roon
  • I ‘whitelisted’ the RoonInstaller64 in Kapersky
  • when I try to run RoonInstaller64 (as Administrator) I get the following error:

Windows cannot access the specified device, path or file. You may not have the appropriate permissions to access the item.

3

Hey @Donald_Brown1 – Thanks for reaching out!

If you right-click and view properties do you notice anything out of the ordinary for the installer? It may also be that the file was deleted by Kaspersky which is why it can’t access the specified path — Can you try re-downloading the installer and let us know if you still see this behavior?

Thanks!
Dylan

4

Thanks for the quick response.

Nothing in the properties looks out of the ordinary. I d/l a new version:

  • ran Malwarebytes on the installer - OK
  • ran Kaspersky on the installer - issue - see attached file - seems to have an issue with the ‘uninstall.exe’ file

image

There seem to be 2 issues here:

  1. I had Roon running as part of a trial since 06/08/18 - everything was OK. Kaspersky suddenly has an issue with this install - is there anything that is automatically updated with an install
  2. Now I’ve uninstalled Roon and am unable to reinstall because Kaspersky has an issue with ‘uninstall.exe’ which I assume is part of the installer package. Is the current installer new since 06/08/18?
5

Thanks for the quick response.

Nothing in the properties looks out of the ordinary. I d/l a new version:

  • ran Malwarebytes on the installer - OK
  • ran Kaspersky on the installer - issue - see attached file - seems to have an issue with the ‘uninstall.exe’ file

image

There seem to be 2 issues here:

  1. I had Roon running as part of a trial since 06/08/18 - everything was OK. Kaspersky suddenly has an issue with this install - is there anything that is automatically updated with an install
  2. Now I’ve uninstalled Roon and am unable to reinstall because Kaspersky has an issue with ‘uninstall.exe’ which I assume is part of the installer package. Is the current installer new since 06/08/18?
    [/quote]
6

Do yourself a favor and Google Kaspersky
THEY are malware

1 Like
7

Hey @Donald_Brown1,

Since Kaspersky is causing some issues here with the installer, here’s what I’d recommend. Temporarily disable Kaspersky, download a fresh installer, and install Roon. With Kaspersky disabled you shouldn’t have any issues here and then you can enable it once more afterward.

Thanks,
Dylan

8

Kaspersky is picking only on the Uninstall.exe file from the installation package. Object name: “UDS:Trojan-Ransom.Win32.Encoder.cl;Trojan program”. It looks like a generic (heuristic) detection from Kaspersky’s Urgent Detection System (UDS). I wouldn’t blame Kaspersky for being overly protective. As an example, read what kind of crap they are trying to protect from, it’s mind blowing: https://www.kaspersky.com/about/press-releases/2018_synack-doppelganging If other antivirus programs are not picking it up I think they simply have weaker protection. In this case, by heuristic analysis, Kaspersky thinks this file might have a virus, it hasn’t matched the signature yet. It’s being overly protective.

Over the past year or so on my PC’s Kaspersky picked only on Roon uninstallers which all turned out to be false positives. Later it stopped picking on those files after they were analyzed by humans at Kaspersky, I guess. But the heuristic engine keeps finding suspected encoders in Roon uninstallers. Which brings up my question.

Why does Roon uninstaller include an encoder/encrypter? What does it encrypt when uninstalling Roon? The installer does not seem to have it. Simple logic suggests that the installer should have an encrypter to hide the proprietary code, the uninstaller can simply delete everything.

9

Hi Dylan,

I’ve got a bit of an issue as I am currently towards the end of a 14-day trial – ends tomorrow I think.

Is there any way I might extend the trial for a week so that I can try to resolve this Kaspersky / Roon issue?

I did try installing Roon to an old laptop without encountering any Kaspersky issues so I think your recommendation (below) might make sense.

Let me know about extending the trial.

Don

10

check roon bridge plz.
I can not install roon bridge because of malware alert.