PSA: iVentoy tool distributing malicious kernel drivers

[SylverReZ]

The most popular tool used by millions to install an OS through the network, called "iVentoy," has been recently updated to include unsafe kernel drivers for Windows-based operating systems. Inside of the archive for Ventoy is a file called "iventoy.dat" located in the "data" folder containing most of its distribution files that it drops. Once it is decrypted in conjunction with a Python script and unpacked, there have been huge red flags detected by major anti-viruses and online cloud scanners such as VirusTotal, labeling the files as 'HookSignTool' and 'Riskware.FakeCert,' even going as far as to label it as a 'rootkit.'

The following malicious files are as follows:

• iventoy.dat.xz\iventoy.dat.\win\wintool.tar.xz
• iventoy.dat.xz\iventoy.dat.\win\wintool.tar.xz\wintool.tar\wintool\64\httpdisk_sig.sys
• iventoy.dat.xz\iventoy.dat.\win\wintool.tar.xz\wintool.tar\wintool\32\httpdisk_sig.sys
• iventoy.dat.xz\iventoy.dat.\win\vtoypxe64.exe
• iventoy.dat.xz\iventoy.dat.\win\vtoypxe32.exe

Avoid running this software if you can regardless of system! Make sure you update your antivirus and do a full scan of your machine. If the device drivers are difficult to remove, either boot into Safe Mode or boot from a recovery disc such as Hiren's Boot CD/DVD to remove the infected drivers.

Source (mirror)

Important sidenote:
To make this clear to anyone to avoid confusion. Ventoy and iVentoy (PXE) are two separate programs! You can continue using Ventoy without any problems for now, except iVentoy. I would, however, still proceed with caution just in-case.

 

[Delta984]

Oh boy. What fun.

 

[a_username_that_is_cool]

i hope this is a xz utils situation where some guy just slipped this in

 

[SylverReZ]

i hope this is a xz utils situation where some guy just slipped this in

I doubt that this was an all done effort by a bad actor similar to XZ utils, rather more likely a mistake. This has been fixed in the latest version currently uploaded to GitHub. Remember that iVentoy is a closed-source tool as compared to Ventoy.

 

[The Real Jdbye]

The most popular tool used by millions to create a bootable USB, called "iVentoy," has been recently updated to include unsafe kernel drivers for Windows-based operating systems. Inside of the archive for Ventoy is a file called "iventoy.dat" located in the "data" folder containing most of its distribution files that it drops. Once it is decrypted in conjunction with a Python script and unpacked, there have been huge red flags detected by major anti-viruses and online cloud scanners such as VirusTotal, labeling the files as 'HookSignTool' and 'Riskware.FakeCert,' even going as far as to label it as a 'rootkit.'

The following malicious files are as follows:

• iventoy.dat.xz\iventoy.dat.\win\wintool.tar.xz
• iventoy.dat.xz\iventoy.dat.\win\wintool.tar.xz\wintool.tar\wintool\64\httpdisk_sig.sys
• iventoy.dat.xz\iventoy.dat.\win\wintool.tar.xz\wintool.tar\wintool\32\httpdisk_sig.sys
• iventoy.dat.xz\iventoy.dat.\win\vtoypxe64.exe
• iventoy.dat.xz\iventoy.dat.\win\vtoypxe32.exe

Avoid running this software if you can regardless of system! Make sure you update your antivirus and do a full scan of your machine. If the device drivers are difficult to remove, either boot into Safe Mode or boot from a recovery disc such as Hiren's Boot CD/DVD to remove the infected drivers.

Source (mirror)

Important sidenote:
To make this clear to anyone to avoid confusion. Ventoy and iVentoy (PXE) are two separate programs! You can continue using Ventoy without any problems for now, except iVentoy. I would, however, still proceed with caution just in-case.

These detections don't scream malware to me. They have the potential to be used maliciously, but so do a lot of other things that legitimate software uses.
I would be wary, but I don't see any reason to conclude this is malware. I would like to hear from the iVentoy creators before making any conclusions.

 

[console]

It's surprise me!

iVentoy and Ventoy are different programs?

I only download both Rufus and Ventoy before. I never download iVentoy. I'm safe 100% or not?

Let me know.

 

[chrisrlink]

well thats what you get for trusting a chinese dev

 

[SylverReZ]

iVentoy and Ventoy are different programs?

Difference between the two is that iVentoy is for network PXE booting and not booting from a USB.