VLC Player triggers a virus alert

[sami22]

Hello.
After My anti-virus software's recent virus definition update (today), I got a problem. When I tried to play a video file that was ok before, my antvir-software quarantined VLC-player on my computer. First I thought there was something wrong in the file, but it was VLC that was quarantined. The same thing happened with any media file I tried to play. I'm using Forticlient and both vlc-1.1.7 & vlc-1.1.6 were quarantined/disabled (the program on C: and the downloaded installation executable) .
Here are some log files:
<Type>Warning <Time>25.2.2011 18:30:06 <Source>AntiVirus
action=accessdenied file=c:\program files\videolan\vlc\vlc.exe virus=HackerTool/Pwdump sig_id=426088 logon_user=xxx msg=AntiVirus realtime protection found virus
<Type>Warning <Time>25.2.2011 18:49:01 <Source>AntiVirus
action=accessdenied file=c:\downloads\vlc-1.1.6-win32.exe virus=HackerTool/Pwdump sig_id=426088 logon_user=xxx msg=AntiVirus realtime protection found virus
<Type>Warning <Time>25.2.2011 18:49:09 <Source>AntiVirus
action=accessdenied file=c:\downloads\vlc-1.1.7-win32.exe virus=HackerTool/Pwdump sig_id=426088 logon_user=xxx msg=AntiVirus realtime protection found virus

Has anyone in this forum encountered similar problems? I couldn't find searching. Could this be an antivir software issue (definition error) or has somebody hacked my VLC with a false media-file or something? I'd hate to start using some other not-so-good player for watching videos. At the moment I seem to have no choice. I don't feel comfortable with VLC and it's not working without disabling my virus-protection.
Thank's for advice

[antonk]

Hi,

I have the same problem. I think there's an error in the FortiClient AV signature/pattern files.
I've tried to delete and reinstall vlc.exe but taht didn't do it either. Personally I'll wait for a new Forticliet signature file.

BR
Anton

[Rémi Denis-Courmont]

There is also the risk that your VLC has a virus if you did not download it from the official website. Or your computer could be infected beforehand and propagate it to VLC.

[antonk]

Problem solved with (AV signtature 12.936) Forticlient update

[sami22]

Thank you guys for your comments
et merci Rémi pour tes préoccupations

I understand the risk of downloading a forged VLC-player from the web and that's why I've done it only from the official site. I've also had my computer protected for years with Forticlient. It seems not to be a crappy software.

Well, I did some double-checking this morning with my mini-laptop, which also has VLC & Forticlient. I first downloaded the latest virus data from Fortinet. Then I played video files with no problems. Then I scanned VLC for viruses and it was clean.
Having last night deleted and uninstalled VLC from my main PC, I started it from standby (in which state I left it). I first tried to check if there was fresh virus data, but there was nothing to update. Then suddenly Forticlient gave me a notice, that it had cleaned my PC from malware, but I had to reboot for a final kill. Well... I rebooted and downloaded the latest VLC, which was not possible yesterday. I installed it with no hassle and run virus-scans on the downloaded .exe & the installed player. Everything seems to be ok now.

One specific thing has come into my mind. The day before yesterday I tried to play a video-file (was maybe an avi or flv, don't remember). The player showed only a blank screen and nothing else. The PC screen flashed a couple of times and I had to use task-manager to kill VLC.
Could it be possible, that video-files can be tampered in a way that, when played the malware is somehow associated with the player? And this is why Forticlient identified VLC as the malware? I know that VideoLAN had some vulnerabilities before, but the team behind VLC has patched them. Hopefully this is not a new one or if it is, it will be patched before there's damage to anyone. The player is the best I've ever come across. A Big Thanks to all the people behind it.

BR, Sami

[sami22]

Hi you all.
All tough everything seems to be ok now, the whole episode puzzles me. I should have checked at the very start the AV quarantined files. There were more quarantined bugs than VLC.
First was vlc.exe, then after six minutes one bug in my temp file and one in Firefox cache file and 20 min later again one in Firefox cache file. So there was definitely some kind of intrusion going on. I have no clue why VLC was associated in the beginning of the attack.
I submitted all 4 quarantined files to FC. Maybe they can get something out of them.
BTW, I got the AV signature 12.936 yesterday evening. In the morning it wasn't yet updated.
Thank's to all.
Sami

[hilaryy]

Hello,
This also happens when there is still virus in media files and anti-virus stop them when they run. so i think first you have to clean your system by formatting that drive and then install anti-virus and then install players again.

cheers!!