Virus detected in DJI Assistant 2 For Mavic 2.0.6

[Cheech Wizard]

Feeding the file viewer.exe to a online virus checkking tool, more engines reporting this file as suspicius/infected:
View attachment 64768

I don't see DJI anywhere on that screen shot. How many "Assistants" are out there? Did you trace it back to its root menu?

 

[Cheech Wizard]

I agree, SuperAntiSpyware is some decent software!

CCLEANER is also good.

 

[AnotherMavicPilot]

CCLEANER is also good.

Yes, good for removing unwanted junk files, temp files, fix reg errors etc. Won't be removing active virus threats though...

 

[zocalo]

"]No, it's not up to DJI; it's up to *both* sides"... WRONG... it's up to you to research and keep your computer clean.

Great if you can do so successfully, but does absolutely nothing to fix the issue of reducing (and preferrably eliminating) the FPs, which is what that part of the discussion was about - it's just treating the symptoms while not tackling the underlying problem. Sure, we can help push DJI & the AV vendors in the right direction by making enough noise about the problem, but the ball is firmly in their courts to fix the problem for good.

 

[zocalo]

I don't see DJI anywhere on that screen shot. How many "Assistants" are out there? Did you trace it back to its root menu?

While there may be other binaries called "assistant[.exe]", the poster stated it was DJI's version and its SHA256 sum matches the one I posted back on the first page which was absolutely obtained from DJI's assistant.exe v2.0.6, and I also posted in another thread on the topic that predates this one. Pretty sure it's the same file.

 

[Cheech Wizard]

Great if you can do so successfully, but does absolutely nothing to fix the issue of reducing (and preferrably eliminating) the FPs, which is what that part of the discussion was about - it's just treating the symptoms while not tackling the underlying problem. Sure, we can help push DJI & the AV vendors in the right direction by making enough noise about the problem, but the ball is firmly in their courts to fix the problem for good.

Wait, I read this whole thread. It's about viruses, spyware and malware. And if you use the programs to find them you should know how to use them. Don't just blindly click "delete all". Google them.

 

[Cheech Wizard]

While there may be other binaries called "assistant[.exe]", the poster stated it was DJI's version and its SHA256 sum matches the one I posted back on the first page which was absolutely obtained from DJI's assistant.exe v2.0.6, and I also posted in another thread on the topic that predates this one. Pretty sure it's the same file.

"Pretty sure"?

 

[Cheech Wizard]

While there may be other binaries called "assistant[.exe]", the poster stated it was DJI's version and its SHA256 sum matches the one I posted back on the first page which was absolutely obtained from DJI's assistant.exe v2.0.6, and I also posted in another thread on the topic that predates this one. Pretty sure it's the same file.

That's why you have to investigate and if it is a False Positive put it in your "White List".

 

[zocalo]

Wait, I read this whole thread. It's about viruses, spyware and malware. And if you use the programs to find them you should know how to use them. Don't just blindly click "delete all". Google them.

Sure, and that's exactly what the OP did, but the point of the part of the thread you were quoting was not about the general handling of malware but the specific issue of how to fix the repeated false positives that DJI's executables seem to be generating. Knowing how to handle a piece of malware when detected or how to identify and whitelist a FP, is not the same thing as having a resonable expectation that something that isn't malware doesn't regularly FP in the first place.

"Pretty sure"?

Sarcastic figure of speech. I think we both know the chances of two different executables with the same name having the same SHA256 sum are pretty much zero, even before you take into account both posters stated it was DJI's assistant.exe v2.0.6.

That's why you have to investigate and if it is a False Positive put it in your "White List".

Again, misses the whole point about fixing the underlying problem (see above). Yes, you're going to get the occassional SNAFU that can be fixed with a whitelist, but you really shouldn't have to do that with multiple release versions of the same executable.


PS. If you hit reply to multiple posts, you can address multiple comments in a single post.

 

[Cheech Wizard]

Sure, and that's exactly what the OP did, but the point of the part of the thread you were quoting was not about the general handling of malware but the specific issue of how to fix the repeated false positives that DJI's executables seem to be generating. Knowing how to handle a piece of malware when detected or how to identify and whitelist a FP, is not the same thing as having a resonable expectation that something that isn't malware doesn't regularly FP in the first place.



Sarcastic figure of speech. I think we both know the chances of two different executables with the same name having the same SHA256 sum are pretty much zero, even before you take into account both posters stated it was DJI's assistant.exe v2.0.6.



Again, misses the whole point about fixing the underlying problem (see above). Yes, you're going to get the occassional SNAFU that can be fixed with a whitelist, but you really shouldn't have to do that with multiple release versions of the same executable.


PS. If you hit reply to multiple posts, you can address multiple comments in a single post.

So, DJI has to check EVERY program that scans for problems? It's not gonna happen.

 

[zocalo]

So, DJI has to check EVERY program that scans for problems? It's not gonna happen.

I don't recall anyone suggesting that. What was suggested was that DJI be consistent in digitally signing their executables before release, then using that consistent signature to help obtain more reliable results from those specific vendors that repeatedly FP and their customers (us) actually complain about. Fix a few of the main/repeat offenders, and they're going to get a significant reduction in the total number of FPs with only a fairly limited amount of effort, especially since many of the smaller players use licensed/open source scanning engines with their own front-end on.

As for checking every program, that's actually more or less achievable with minimal fuss - DJI would just need to submit the code to VirusTotal, etc. before public release and see if anything flags it, which can be automated pretty easily. Of course, if something did flag it and was deemed important enough to be a concern, then DJI would need to figure out why they were getting the FP and fix the problem, which might be a bit more challenging...

 

[Cheech Wizard]

Macs and iOS don’t do this and my Kaspersky doesn’t warn me. My Apple devices do warn that all the DJI software is unsigned. It’s a platform specific problem. I agree that they should warn the user.

I think people are finding these "False Positives", when they scan with various Anti Spyware, Anti Malware,... etc. It's a good practice to look at files they are deleting and if you aren't sure... DON"T REMOVE IT! Just uncheck it in the menu.. or the "Finish" button. I don't like it when I get no "Issues" in my various scans. I know SOMETHING is there every month or so.
Any Program that has permission to change system settings or run executables is usually Tagged as a Virus or PUP, (potentially unsafe program). Computers seem daunting, but they are only as smart as you.

Most people have some knowledge in this forum and I hope I'm not boring you.

 

[Cpt.Barbossa1072]

 

[Cheech Wizard]

View attachment 66422

WOW!

 

[DBowie]

When I try to install the dji+2+for+assistant+mavic+2.0.6 I get in a big red box: This app is blocked for your own safety!

 

[Thomas B]

When I try to install the dji+2+for+assistant+mavic+2.0.6 I get in a big red box: This app is blocked for your own safety!

Sure it does. As stated above and explained... unsigned certificate. Work around is above. Or see below: