Panda Cloud false positive? WUDFHost.exe

Hey guys,

i´ve just downloaded Winrar from softpedia (x32, softpedia secure download), and while installing Panda Cloud detected a virus. It comes to be WUDFHost.exe, located in C:\Program Files\Common Files\Windows Driver Foundation\WUDFHost.exe. I entered in shadow mode and tried to recover the file from quarantine to send to Virus Total, but the file wasn't there, neither in that location. In the report the detection is shown as a "suspect item".

After googling a bit it seems that WUFHost.exe is a Microsoft file, so i'm wondering if the removal of that file will cause problems to my Windows installation...

 

Nothing being detected on my end, no one reported it also on the Panda Cloud forums yet. Will you post your event log please?

 

Here it goes:

 

Interesting since that's a windows file I always though that OS files were whitelisted in the cloud. Were you able to restore the file? I will see if I can find someone to look into it.

By the way I just checked and my WUDFhost.exe is located in the Windows System32 folder on the machine.

 

I have Panda Cloud and WinRAR on my netbook and no such problem.

 

No, Panda "says" that there's something in quarantine but there's nothing there:

 

You said you have ShadowDefender? I wonder if this has something to do with Shadowmode.

 

I have Shadow Defender but i only use it on-demand, when i want to test software. When Panda detected the file shadow mode was off.

 

No problems whatsoever here running SD with PCAV.

 

Just checked my other computers and none of them have had a detection like this.

 

+1

 

Way to go Panda.....it seems they MUST DESPERATELY IMPLEMENT that "ask before any option" sooner than everything,before destroying someone's pc

 

Looks like an 'oddball' for sure.
What has WUDFhost.exe got to do with WinRaR?

Can anyone with Win7 confirm the location of WUDFhost.exe like yours?
Perhaps it is a rogue or a ghost!

 

My computer now only boots in safe mode lol. According to what i've read, the original location of WUDFHost.exe is in system32 folder, so maybe it is virus?

That's not the computer i have in my signature, in this one i only have Panda Cloud AV and Shadow Defender (on-demand), and i use it mostly to test software.

It would be interesting to know if the problem is a malware infection and from where (maybe softpedia winrar installer is compromissed? a drive-by? for any brave who wants to test it, here's the link -http://www.softpedia.com/dyn-postdownload.php?p=2461&t=0&i=1- or a problem with Panda.

Anyway is cool to have the opportunity to fix my own computer

 

Thats the weird thing I have yet to see any other cases of this happening.

 

Do you use it for malware testing?

 

the WUDFHost.exe is in the system32 directory, no detection by PCAV here.

 

I was able to restore the normal startup using "startup repair".

@The Hammer
No, i dont use it for malware testing.

@dasorin
The detection occurred in C:\Program Files\Common Files\Windows Driver Foundation\WUDFHost.exe

I did a full scan with Emsisoft Emergency Kit that came with this:

I uploaded the file to VirusTotal and AntiVir, Ikarus and Emsisoft identifies the file as malware. I suspect a lot that the WinRar installer was infected, since the Panda detection happened while installing that program. I'll try to access the quarantine folder (from Panda Cloud) through windows explorer to see if i can recover the file.

 

Ibrad,

Can i PM you the file i recovered from the quarantine folder?

 

If you PM a download link to the file that casued the issue I will send the link out to someone on the malware research time and see what they think of the file if you would like.

 

PM sent

 

Now that I think of it does Softpedia still work off mirrors provided off different companies servers? All it would take is one of these mirrors to become hacked to provide a fake version of WinRar that would only infect some.