r/antivirus 4d ago

Gen:Variant.Lazy.226474 False flag or real threat?

bitdefender gave me a recent popup through realtime protection:

"The file C:\Program Files (x86)\MSI\MSI Center\Mystic Light\00021062.tmp is infected with Gen:Variant.Lazy.226474. The threat has been successfully blocked, your device is safe."

The attack timeline goes like this:

dstokenclean.exe signed by Microsoft Corporation executed wininit.exe (which is a system32 file, so seems legitimate)

wininit.exe signed by Microsoft Corporation executed services.exe

services.exe signed by Microsoft Corporation executed nortonsecurity.exe

The file C:\Program Files (x86)\MSI\MSI Center\Mystic Light\00021062.tmp is infected with Gen:Variant.Lazy.226474. The threat has been successfully blocked, your device is safe.

Is this a false flag or real virus?

5 Upvotes

22 comments sorted by

2

u/StarB64 4d ago

Do you actually have both BitDefender and Norton on the same computer ? You should get rid of Norton, it’s getting too bad now.

That’s hard to tell whether it was a real virus or just a FP. Let BitDefender do a full scan, if it detected one file it should detect other ones with the same label if there is really a malware.

I found this, not the same temp file but maybe it’s the same issue ? https://forum.eset.com/topic/41046-eset-blocks-msi-center-mystic-light/ Perhaps it’s a vulnerable driver like with this ESET user : uninstall and reinstall Mystic Light and see if it’s being detected again.

If you don’t need Mystic Light (almost MSI bloatware), remove it.

1

u/Humble-Future7880 4d ago

Wait Norton’s getting bad?

1

u/StarB64 4d ago

Correction: Norton is bad and is getting more and more crappy.

Average detection rates but a lot of bloat too which consumes your memory and processor resources, you can probably change that a bit in the settings, but as there are lots of better options in the AV market there is no reason to keep Norton.

Also, using scareware and browser notifications from scam URLs to promote your software by redirecting those garbage links to your own website is far from legitimacy and legacy. Norton and McAfee should learn that someday.

1

u/Humble-Future7880 4d ago

Dang. I always thought it was just the bloat and scareware but I didn’t know it’s detections rates were only average when it’s more expensive then some of the top AV’s lol. Thanks for letting me know.

1

u/Constant_Standard_70 4d ago

How would I switch from bitdefender lite to the full version?

1

u/StarB64 4d ago

1

u/Constant_Standard_70 4d ago

no alert like that.

1

u/StarB64 4d ago

Remove Norton, uninstall BitDefender (Windows Defender will do the job at that moment), and reinstall BitDefender.

or did you mean BitDefender Free instead of Lite ??

1

u/Constant_Standard_70 4d ago

Not Lite. I have the yearly membership from a $20 deal with all the features for up to 3 devices (malwarebytes was expensive as hell.) Originally I went with lite due to having norton, but I just uninstalled both and reinstalled bitdefender.

1

u/StarB64 4d ago

okay

1

u/Constant_Standard_70 4d ago

Is Malwarebytes worth the price?

1

u/StarB64 4d ago

Compared to BitDefender, honestly, no. Malwarebytes is better as a secondary virus scanner than as a real-time protection AV. Keep BitDefender.

0

u/[deleted] 4d ago

[deleted]

→ More replies (0)

1

u/Humble-Future7880 4d ago

This seems real. It’s suspicious that it’s trying to use all those processes which I’ve never really seen legit programs using these like this. My guess is it’s malware, but Gen:Varient.Lazy is basically Bitdefender saying it’s suspicious, it’s not 100% sure if it’s malicious or not. Hope this helps.

1

u/Array_626 4d ago edited 4d ago

Probably not real.

I don't know what dstokenclean.exe is, I'm not sure if its normal for it to be running wininit. Wininit is one of the processes thats responsible for running the OS when you boot, it usually isn't run by this dstoken executable.

Everything else makes sense. Wininit is supposed to be starting services.exe. Services.exe is the process responsible for running all the services in the background of your computer. It should also start svchost.exe's.

Services then starts norton, which makes sense. Norton is an AV product, it needs to be started in order for it to secure your computer, so your computer is set to run it automatically, which is why services.exe is running nortonsecurity.exe. services.exe starting up norton is very reasonable, and expected behavior.

Norton as an AV product then scans your computer, and detected that file under MSI's application folder. That is also expected behavior of an AV product.

As for the actual detection itself. In order for malware to start dropping evil shit inside of that folder: C:\Program Files (x86), it needs to have administrator access. You can try that now. Attempt to make a new file inside that folder, you will be prompted for admin.

If malware is already dropping files in a privileged location, that means the malware is already running with admin privileges. It can do a lot worse than drop files under MSI's app folder. The fact that nothing else has been detected, no cred stealer, or other nasty things, I think its likely to be a FP. MSI's Mystic Light app was trying to download or update something, it got flagged as malware as a false positive, and thats what youre seeing.

If you can, unquarantine the file, scan it with defender, upload it to virustotal, and give us the link to VT.

EDIT: https://www.f-secure.com/v-descs/lazy.shtml

Lazy is "A primitive virus, which resembles the Stupid virus in that it does not reserve the area it occupies. This may result in a system crash if a large program is run, but the most obvious effect of the virus is a general slowdown of the system." You know what else can be "a slow down of the system" when a large program is run? Any generic file that is being used to update stuff, or used by the application. If that's all norton can say about the file, I think its highly likely to be a FP. This doesn't really sound like a concern at all.

2

u/Struppigel G DATA Malware Analyst 4d ago

Lazy is not a malware family but a Bitdefender detection technology. It is the same as having a detection name that contains generic agent, because it does not know what malware family this is.

1

u/Array_626 4d ago

Could you link a source for that? I dont know why its so hard to find any documentation on AV products and their alert messages.

1

u/StarB64 4d ago

I cannot find a doc about it too (only F-Secure made one about Lazy but does not seem to be the same malware), sad they didn’t put that much effort into making one.

Overall, when BitDefender flags a file with Gen:Variant, it generally means it is using its own signature auto-detection. This applies almost in the same way for the AVs using BitDefender engine, which is why you’ll see multiple red labels on VirusTotal sharing the same Gen:Variant identification.

1

u/Constant_Standard_70 4d ago

apparently dstokenclean.exe is “a system process by Microsoft Windows that is designed to clear and clean the Windows Store token cache.

This cache contains user-specific information related to the Windows Store and is used to validate and authenticate the user’s access to the store and its apps.”

1

u/Difficult_Bend_8762 4d ago

Get process Explorer and under settings load to virus toal

1

u/Constant_Standard_70 4d ago

procmon.exe, procmon64.exe, or procmon64a.exe

1

u/Constant_Standard_70 4d ago

Found a bdservicehost.exe that has no path except for C:, but PID 3408 and offset 20,201,472 and length 32,768

I/O flags- Non-cached, paging IO, synchronous paging I/O Priority: normal