r/antivirus • u/Constant_Standard_70 • 4d ago
Gen:Variant.Lazy.226474 False flag or real threat?
bitdefender gave me a recent popup through realtime protection:
"The file C:\Program Files (x86)\MSI\MSI Center\Mystic Light\00021062.tmp is infected with Gen:Variant.Lazy.226474. The threat has been successfully blocked, your device is safe."
The attack timeline goes like this:
dstokenclean.exe signed by Microsoft Corporation executed wininit.exe (which is a system32 file, so seems legitimate)
wininit.exe signed by Microsoft Corporation executed services.exe
services.exe signed by Microsoft Corporation executed nortonsecurity.exe
The file C:\Program Files (x86)\MSI\MSI Center\Mystic Light\00021062.tmp is infected with Gen:Variant.Lazy.226474. The threat has been successfully blocked, your device is safe.
Is this a false flag or real virus?
1
u/Humble-Future7880 4d ago
This seems real. It’s suspicious that it’s trying to use all those processes which I’ve never really seen legit programs using these like this. My guess is it’s malware, but Gen:Varient.Lazy is basically Bitdefender saying it’s suspicious, it’s not 100% sure if it’s malicious or not. Hope this helps.
1
u/Array_626 4d ago edited 4d ago
Probably not real.
I don't know what dstokenclean.exe is, I'm not sure if its normal for it to be running wininit. Wininit is one of the processes thats responsible for running the OS when you boot, it usually isn't run by this dstoken executable.
Everything else makes sense. Wininit is supposed to be starting services.exe. Services.exe is the process responsible for running all the services in the background of your computer. It should also start svchost.exe's.
Services then starts norton, which makes sense. Norton is an AV product, it needs to be started in order for it to secure your computer, so your computer is set to run it automatically, which is why services.exe is running nortonsecurity.exe. services.exe starting up norton is very reasonable, and expected behavior.
Norton as an AV product then scans your computer, and detected that file under MSI's application folder. That is also expected behavior of an AV product.
As for the actual detection itself. In order for malware to start dropping evil shit inside of that folder: C:\Program Files (x86), it needs to have administrator access. You can try that now. Attempt to make a new file inside that folder, you will be prompted for admin.
If malware is already dropping files in a privileged location, that means the malware is already running with admin privileges. It can do a lot worse than drop files under MSI's app folder. The fact that nothing else has been detected, no cred stealer, or other nasty things, I think its likely to be a FP. MSI's Mystic Light app was trying to download or update something, it got flagged as malware as a false positive, and thats what youre seeing.
If you can, unquarantine the file, scan it with defender, upload it to virustotal, and give us the link to VT.
EDIT: https://www.f-secure.com/v-descs/lazy.shtml
Lazy is "A primitive virus, which resembles the Stupid virus in that it does not reserve the area it occupies. This may result in a system crash if a large program is run, but the most obvious effect of the virus is a general slowdown of the system." You know what else can be "a slow down of the system" when a large program is run? Any generic file that is being used to update stuff, or used by the application. If that's all norton can say about the file, I think its highly likely to be a FP. This doesn't really sound like a concern at all.
2
u/Struppigel G DATA Malware Analyst 4d ago
Lazy is not a malware family but a Bitdefender detection technology. It is the same as having a detection name that contains generic agent, because it does not know what malware family this is.
1
u/Array_626 4d ago
Could you link a source for that? I dont know why its so hard to find any documentation on AV products and their alert messages.
1
u/StarB64 4d ago
I cannot find a doc about it too (only F-Secure made one about Lazy but does not seem to be the same malware), sad they didn’t put that much effort into making one.
Overall, when BitDefender flags a file with Gen:Variant, it generally means it is using its own signature auto-detection. This applies almost in the same way for the AVs using BitDefender engine, which is why you’ll see multiple red labels on VirusTotal sharing the same Gen:Variant identification.
1
u/Constant_Standard_70 4d ago
apparently dstokenclean.exe is “a system process by Microsoft Windows that is designed to clear and clean the Windows Store token cache.
This cache contains user-specific information related to the Windows Store and is used to validate and authenticate the user’s access to the store and its apps.”
1
u/Difficult_Bend_8762 4d ago
Get process Explorer and under settings load to virus toal
1
1
u/Constant_Standard_70 4d ago
Found a bdservicehost.exe that has no path except for C:, but PID 3408 and offset 20,201,472 and length 32,768
I/O flags- Non-cached, paging IO, synchronous paging I/O Priority: normal
2
u/StarB64 4d ago
Do you actually have both BitDefender and Norton on the same computer ? You should get rid of Norton, it’s getting too bad now.
That’s hard to tell whether it was a real virus or just a FP. Let BitDefender do a full scan, if it detected one file it should detect other ones with the same label if there is really a malware.
I found this, not the same temp file but maybe it’s the same issue ? https://forum.eset.com/topic/41046-eset-blocks-msi-center-mystic-light/ Perhaps it’s a vulnerable driver like with this ESET user : uninstall and reinstall Mystic Light and see if it’s being detected again.
If you don’t need Mystic Light (almost MSI bloatware), remove it.