Would someone please do a virus can on this file for me

[Rotten Ronny]

At this link
http://sourceforge.net/project/showf...kage_id=205228
this file bs2b_winamp-2.1.0-bin.zip comes up as a Trojan in the Avast scan.
I'm fairly certain it is a false positive but would appreciate if someone
would confirm that for me with a different AV scanner.

[Leythos]

In article <9paMk.144919$ZW7.67669@fe10.news.easynews.com>,
rotten@ronny.here says...
> At this link
> http://sourceforge.net/project/showf...kage_id=205228
> this file bs2b_winamp-2.1.0-bin.zip comes up as a Trojan in the Avast scan.
> I'm fairly certain it is a false positive but would appreciate if someone
> would confirm that for me with a different AV scanner.
>
>
Why wouldn't you download it from the vendors site?

http://www.winamp.com/player

SourceForge is not known for hosting malware, but why not get it from
the vendors site instead?

--
- Igitur qui desiderat pacem, praeparet bellum.
- Calling an illegal alien an "undocumented worker" is like calling a
drug dealer an "unlicensed pharmacist"
spam999free@rrohio.com (remove 999 for proper email address)

[Dustin Cook]

Leythos <spam999free@rrohio.com> wrote in
news:MPG.236b01ecdbfa3f27989683@us.news.astraweb.c om:

> In article <9paMk.144919$ZW7.67669@fe10.news.easynews.com>,
> rotten@ronny.here says...
>> At this link
>> http://sourceforge.net/project/showf...1236&package_i
>> d=205228 this file bs2b_winamp-2.1.0-bin.zip comes up as a Trojan in
>> the Avast scan. I'm fairly certain it is a false positive but would
>> appreciate if someone would confirm that for me with a different AV
>> scanner.
>>
>>
> Why wouldn't you download it from the vendors site?
>
> http://www.winamp.com/player
>
> SourceForge is not known for hosting malware, but why not get it from
> the vendors site instead?
>

It's not winamp, it's a plugin by a 3rd party....
Kinda kewl actually.


--
Regards,
Dustin Cook, Author of BugHunter
BugHunter - http://bughunter.it-mate.co.uk
MalwareBytes - http://www.malwarebytes.org

[Rotten Ronny]

"Dustin Cook" <bughunter.dustin@gmail.com> wrote in message
news:Xns9B40E9DE6DB2HHI2948AJD832@69.16.185.250...
> It's not winamp, it's a plugin by a 3rd party....
> Kinda kewl actually.

You mean the Trojan is "kewl" or the plugin is? I've used this plugin before
(old download) and it has never came up as containing a Trojan until now.
Before I was using AVG and not Avast when I scanned it.

[Andy Walker]

Leythos wrote:

>In article <9paMk.144919$ZW7.67669@fe10.news.easynews.com>,
>rotten@ronny.here says...
>> At this link
>> http://sourceforge.net/project/showf...kage_id=205228
>> this file bs2b_winamp-2.1.0-bin.zip comes up as a Trojan in the Avast scan.
>> I'm fairly certain it is a false positive but would appreciate if someone
>> would confirm that for me with a different AV scanner.
>>
>>
>Why wouldn't you download it from the vendors site?
>
>http://www.winamp.com/player
>
>SourceForge is not known for hosting malware, but why not get it from
>the vendors site instead?

It looks like a plugin for Winamp and not Winamp itself.

It's definitely a load of malware...

http://www.virustotal.com/analisis/7...fec7f9cb34e228

[Leythos]

In article <49013902.686249875@news.webtv.com>, awalker@nspank.invalid
says...
> Leythos wrote:
>
> >In article <9paMk.144919$ZW7.67669@fe10.news.easynews.com>,
> >rotten@ronny.here says...
> >> At this link
> >> http://sourceforge.net/project/showf...kage_id=205228
> >> this file bs2b_winamp-2.1.0-bin.zip comes up as a Trojan in the Avast scan.
> >> I'm fairly certain it is a false positive but would appreciate if someone
> >> would confirm that for me with a different AV scanner.
> >>
> >>
> >Why wouldn't you download it from the vendors site?
> >
> >http://www.winamp.com/player
> >
> >SourceForge is not known for hosting malware, but why not get it from
> >the vendors site instead?
>
> It looks like a plugin for Winamp and not Winamp itself.
>
> It's definitely a load of malware...
>
> http://www.virustotal.com/analisis/7...fec7f9cb34e228

Thanks for letting me know. I thought sourceforge was a reputable
download site, guess I'll have to scratch that one.

--
- Igitur qui desiderat pacem, praeparet bellum.
- Calling an illegal alien an "undocumented worker" is like calling a
drug dealer an "unlicensed pharmacist"
spam999free@rrohio.com (remove 999 for proper email address)

[Andy Walker]

Leythos wrote:

>In article <49013902.686249875@news.webtv.com>, awalker@nspank.invalid
>says...
>> Leythos wrote:
>>
>> >In article <9paMk.144919$ZW7.67669@fe10.news.easynews.com>,
>> >rotten@ronny.here says...
>> >> At this link
>> >> http://sourceforge.net/project/showf...kage_id=205228
>> >> this file bs2b_winamp-2.1.0-bin.zip comes up as a Trojan in the Avast scan.
>> >> I'm fairly certain it is a false positive but would appreciate if someone
>> >> would confirm that for me with a different AV scanner.
>> >>
>> >>
>> >Why wouldn't you download it from the vendors site?
>> >
>> >http://www.winamp.com/player
>> >
>> >SourceForge is not known for hosting malware, but why not get it from
>> >the vendors site instead?
>>
>> It looks like a plugin for Winamp and not Winamp itself.
>>
>> It's definitely a load of malware...
>>
>> http://www.virustotal.com/analisis/7...fec7f9cb34e228
>
>Thanks for letting me know. I thought sourceforge was a reputable
>download site, guess I'll have to scratch that one.

As with any repository there can always be something lurking that
hasn't been scanned properly, or was deposited before it was a known
problem. I take the position that anything downloaded from a third
party site should be considered a threat until thoroughly
investigated. Sourceforge is a great resource, and I think that it is
by an large a safe provider of services, but as always you have to
protect yourself when getting anything for free (or paying for it for
that matter.)

Sourceforge does have a form to submit security related incidents if
the OP would like to take the initiative...

http://sourceforge.net/tracker/?func...=1&atid=200001

[Rotten Ronny]

"Andy Walker" <awalker@nspank.invalid> wrote in message
news:49013f1c.687811921@news.webtv.com...
> Sourceforge does have a form to submit security related incidents if
> the OP would like to take the initiative...
>
> http://sourceforge.net/tracker/?func...=1&atid=200001


OK, I'll do that now. Thanks.

[Rotten Ronny]

"Andy Walker" <awalker@nspank.invalid> wrote in message
news:49013902.686249875@news.webtv.com...
> It looks like a plugin for Winamp and not Winamp itself.
>
> It's definitely a load of malware...

Spybot scans for Trojans too and it doesn't throw up any flags.

[Lil' Abner]

Andy Walker <awalker@nspank.invalid> wrote in
news:49013902.686249875@news.webtv.com:

> Leythos wrote:
>
>>In article <9paMk.144919$ZW7.67669@fe10.news.easynews.com>,
>>rotten@ronny.here says...
>>> At this link
>>> http://sourceforge.net/project/showf...51236&package_
>>> id=205228 this file bs2b_winamp-2.1.0-bin.zip comes up as a Trojan
>>> in the Avast scan. I'm fairly certain it is a false positive but
>>> would appreciate if someone would confirm that for me with a
>>> different AV scanner.
>>>
>>>
>>Why wouldn't you download it from the vendors site?
>>
>>http://www.winamp.com/player
>>
>>SourceForge is not known for hosting malware, but why not get it from
>>the vendors site instead?
>
> It looks like a plugin for Winamp and not Winamp itself.
>
> It's definitely a load of malware...
>
> http://www.virustotal.com/analisis/7...fec7f9cb34e228

Wow, if you unzip it and run Virus Total on the dll file, it's worse!
http://www.virustotal.com/analisis/7...ce63a30ae286e9

--
- The bible was written by the same people who said the earth was flat -