CobaltFusion/DebugViewPP

Debugview++ classified as Trojan Win32/Zpevdo.B by Windows Defender

monty241 opened this issue · 5 comments

monty241 commented

Reproduction:

  • Download debugview++.msi version 1.8.0.44 using Google Chrome (productie channel).
  • Automatically blocked and classified as trojan Win32/Zpevdo.B

See pictures.

image

image

image

janwilmans commented

I have had similar problems myself at my company, where mcafee classified it as a different kind of heuristic thread. I've tried to remove certain API calls to see if that would have, but no luck... I would be happy to fix this but, I have no idea why its being classified as a trojan. Of course debugview++ does use debug-api's but, there is really no choise, its a debugging application :)

janwilmans commented

If you google Zpevdo.B you will see that more people struggle with false positives of this kind...

janwilmans commented

I've submitted this case to Windows Defender
image

  • 👍1
janwilmans commented

Good news, its been marked as a false-positive and removed from detection.

image

janwilmans commented

closing... please re-open if more troubles are encountered