Re: BitDefender false positive on 2 files?

On Thu, Apr 09, 2026 at 08:05:02PM -0300, Santiago Roland wrote:
> Hi, i just run Bit Defender full scan on the mirror server and it detected 2 files as malware.
> 
> /pool/main/p/pocsuite3/pocsuite3_1.9.6.orig.tar.gz
> Threat name: Trojan.GenericKD.79774915

As the package's Description, pocsuite is a "Open-sourced remote
vulnerability testing framework".

It provides tools like shellcodes, pocs, php webshells, reverse shells.
For example:

https://sources.debian.org/src/pocsuite3/2.1.0-1/pocsuite3/pocs
https://sources.debian.org/src/pocsuite3/2.1.0-1/pocsuite3/shellcodes
https://sources.debian.org/src/pocsuite3/2.1.0-1/pocsuite3/modules/listener/reverse_tcp.py

Virustotal Analysis: https://www.virustotal.com/gui/file/9eb2b90dafabafc9fb3d2769b81b41b46edde0048b8b3fdd27a08c97b6768922

> /pool/main/i/impacket/impacket_0.12.0.orig.tar.gz
> Threat name: Adware.GenericKD.61104868

impacket is also a security-focused python library. For example, they
provide a ntlmrelayx module, which would be used to perform SMB Relay
attacks.

https://github.com/SecureAuthCorp/impacket
https://github.com/fortra/impacket/blob/master/examples/ntlmrelayx.py

Virustotal Analysis: https://www.virustotal.com/gui/file/1c41951a29c03a03ff749ad68caa0f050072873850c09d7a7f1bca75c41fd66c

> Could this be a false positive? Should i add an exclusion on these?

If you find something like that on your laptop, you're probably a victim.
Bit Defender or other anti-virus performs checks based on pattern. They
may not know you're hosting a debian-mirror.

But in a debian-mirror case, they're harmless as they're just TAR files.
Adding an exclusion on these should be fine.

Best regards,
Tianyu Chen