Virus Warning with BIOS Update download from the Lenovo site

[cannonwill]

I received the following message from our web filter when downloading a BIOS Update utility for my Lenovo X61 Tablet.  I could not find anywhere to report this and will not use this update unless I hear otherwise.  I will provide the information in the message and the location from which I downloaded it:

This email is from the Barracuda Web Filter. We have detected and blocked the download of: VIRUS DOS.Junkie-1

from the server:download.lenovo.com

with the URL of:http://download.lenovo.com/ibmdl/pub/pc/pccbbs/mobiles/7suj18uc.iso

http://support.lenovo.com/en_US/downloads/detail.page?DocID=DS013881

This download was for the BIOS Updated CD.

[andyP Community SuperMod]

That's alarming!

I've just downloaded the file (twice) and also scanned it after downloading without receiving any warning. I have ESET Smart Security 4 business edition installed on my system.

Are you able to try downloading with a different system, or maybe other members could chime in who have different setups?

edit; typo

[Mark_Lenovo Administrator]

Cannonwill,

I've noted this for our support team and we'll check out the file and the page.   Several of the forum mods have tested with different packages and didn't find anything reported.

Do you have an AV program on your system and have you tried a scan of your system yet?  If not, might be a good idea as a precaution.

Thanks for reporting this.

Mark

[TuuS]

I downloaded and scanned it with the latest kaspersky internet security, which reports it's clean. 

This is most likely what's referred to as a "false positive"

http://malware.wikia.com/wiki/False_positive

It might be a sign that you need to consider a different anti virus program, or at very least report this to your current anti virus so they can test it and fix the problem on their end. If they find something that they really believe is a threat, they can provide the proper technical information direct to lenovo, but I believe it's just a simple error on their virus definition database.

[Mornsgrans]

Using Avira: No alert

[cannonwill · Accepted solution]

I also scanned the file and used both Symantec AV Corporate and AVG and found no problems.  There has been no other activity or problem that points to any danger.  The only indication that has created any concern is the report we received from this Barracuda web filter.  I think I will forward this information to them.  Otherwise, I think we can consider this on non-issue and this thread can be closed.  Thanks for your attention.

[Mark_Lenovo Administrator]

Cannonwill,

Thanks for the follow up - much appreciated.   Likewise, thanks to all the other community members who dived in to help test and determine if this were real or a false positive.  Better safe than sorry!

Mark

[goretsky Community Moderator]

Hello,

I just downloaded a copy of the ThinkPad X31 BIOS update and then re-uploaded it to VirusTotal, OPSWAT's Metascan and Jotti's VirusScan, which are the three most popular "meta-engine" virus scanning web sites and between them use about ninety antivirus programs to scan uploaded files, although there is quite a bit of overlap between them.

Here are the results:

VirusTotal:  One (1) anti-malware program out of forty-two (42) reported an infection

MetaScan:  One (1) anti-malware program out of thirty-one (31) reported an infection

Jotti:  Three (3) anti-malware programs out of twenty (20) reported an infection

Although the last one does sound a little alarming, in the context of which engines detected a threat, and what was detected, (an old DOS-era virus, apparently)  I think it is very likely you are seeing a report of a false alarm, e.g., a claim that virus is present when none actually exists.

Regards,

Aryeh Goretsky