Would someone please do a virus can on this file for me

[Rotten Ronny]

"Dustin Cook" <bughunter.dustin@gmail.com> wrote in message
news:Xns9B40E9DE6DB2HHI2948AJD832@69.16.185.250...
> It's not winamp, it's a plugin by a 3rd party....
> Kinda kewl actually.

You mean the Trojan is "kewl" or the plugin is? I've used this plugin before
(old download) and it has never came up as containing a Trojan until now.
Before I was using AVG and not Avast when I scanned it.

[Lil' Abner]

Andy Walker <awalker@nspank.invalid> wrote in
news:49013902.686249875@news.webtv.com:

> Leythos wrote:
>
>>In article <9paMk.144919$ZW7.67669@fe10.news.easynews.com>,
>>rotten@ronny.here says...
>>> At this link
>>> http://sourceforge.net/project/showf...51236&package_
>>> id=205228 this file bs2b_winamp-2.1.0-bin.zip comes up as a Trojan
>>> in the Avast scan. I'm fairly certain it is a false positive but
>>> would appreciate if someone would confirm that for me with a
>>> different AV scanner.
>>>
>>>
>>Why wouldn't you download it from the vendors site?
>>
>>http://www.winamp.com/player
>>
>>SourceForge is not known for hosting malware, but why not get it from
>>the vendors site instead?
>
> It looks like a plugin for Winamp and not Winamp itself.
>
> It's definitely a load of malware...
>
> http://www.virustotal.com/analisis/7...fec7f9cb34e228

Wow, if you unzip it and run Virus Total on the dll file, it's worse!
http://www.virustotal.com/analisis/7...ce63a30ae286e9

--
- The bible was written by the same people who said the earth was flat -

[Rotten Ronny]

"Lil' Abner" <blvstk@dogpatch.com> wrote in message
news:Xns9B42DA989BF5butter@wefb973cbe498...
> Wow, if you unzip it and run Virus Total on the dll file, it's worse!
> http://www.virustotal.com/analisis/7...ce63a30ae286e9

Still possible they are all reporting a false positive. Maybe someone can
run it in a sanbox and see what it does.

[Lil' Abner]

"Rotten Ronny" <rotten@ronny.here> wrote in
news:G0BMk.127805$9s3.99389@fe07.news.easynews.com :

> "Lil' Abner" <blvstk@dogpatch.com> wrote in message
> news:Xns9B42DA989BF5butter@wefb973cbe498...
>> Wow, if you unzip it and run Virus Total on the dll file, it's worse!
>> http://www.virustotal.com/analisis/7...ce63a30ae286e9
>
> Still possible they are all reporting a false positive. Maybe someone
> can run it in a sanbox and see what it does.

I ran it in a virtual PC last night, but it wouldn't install because WinAmp
isn't installed. If I get time today, I'll install WinAmp and try it again.

--
- The bible was written by the same people who said the earth was flat -

[Rotten Ronny]

"Lil' Abner" <blvstk@dogpatch.com> wrote in message
news:Xns9B427417890E1butter@wefb973cbe498...
> I ran it in a virtual PC last night, but it wouldn't install because
> WinAmp
> isn't installed. If I get time today, I'll install WinAmp and try it
> again.

OK, thanks. That plugin works in MediaMonkey too.

[Lil' Abner]

"Rotten Ronny" <rotten@ronny.here> wrote in news:GoKMk.87083$Dw1.9437
@fe01.news.easynews.com:

> "Lil' Abner" <blvstk@dogpatch.com> wrote in message
> news:Xns9B427417890E1butter@wefb973cbe498...
>> I ran it in a virtual PC last night, but it wouldn't install because
>> WinAmp
>> isn't installed. If I get time today, I'll install WinAmp and try it
>> again.
>
> OK, thanks. That plugin works in MediaMonkey too.

OK. I ran Malwarebytes AntiMalware before I started. It was clean.
I installed WinAmp, and then the plugin. The installation went smoothly. I
didn't try the plugin because I have no idea what it is anyway... :-)
Then I ran Malwarebytes AntiMalware again. The results at
http://mewnlite.com/mbytes.gif

--
- The bible was written by the same people who said the earth was flat -

[Rotten Ronny]

"Lil' Abner" <blvstk@dogpatch.com> wrote in message
news:Xns9B42F1A6AED58butter@wefb973cbe498...
> OK. I ran Malwarebytes AntiMalware before I started. It was clean.
> I installed WinAmp, and then the plugin. The installation went smoothly. I
> didn't try the plugin because I have no idea what it is anyway... :-)
> Then I ran Malwarebytes AntiMalware again. The results at
> http://mewnlite.com/mbytes.gif

OK, thanks for the info. I've deleted the file now. I had a copy on my
external HDD that I downloaded a long time ago and that comes up as having
the Trojan too. I had used it too because AVG never showed it as having a
Trojan. All the other files form the same author show as clean though. There
is a version for foobar and it is clean.

That plugin adds crossfeed for headphone use. Lots of older recordings you
hear too much instrument separation in one ear or the other and it sounds
awful so the plugin makes it sound like the instruments are more central in
your head and more natural. Newer recordings don't usually have that issue
but older ones often do. Lots of older Beatles recordings have that issue so
the plugin corrects it for you. There are other plugins available that do
the same thing so will use one of those instead.

[David H. Lipman]

From: "Rotten Ronny" <rotten@ronny.here>

| At this link
| http://sourceforge.net/project/showf...kage_id=205228
| this file bs2b_winamp-2.1.0-bin.zip comes up as a Trojan in the Avast scan.
| I'm fairly certain it is a false positive but would appreciate if someone
| would confirm that for me with a different AV scanner.


UPDATE:

This appears to be a MASS False Positive.

AV vendors are now retracting their declararions of this being malware and several AV
vendor are looking at how and why this was falsely declared as malware.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp

[Bruce Chiles]

A partial return to the status quo ante bellum....

http://univercia.blogspot.com/

"Cacophonies of the New American KILLERS..."

http://americanassassination.blogspot.com/

http://elie-hobeika.blogspot.com/

http://wiredlebanon.blogspot.com/

http://phoeniciaphoenix.blogspot.com/

http://hobeika.blogspot.com/

http://hk-elie-hobeika.blogspot.com/

http://anaconda-manifesto.blogspot.com/

http://lebaneseresistance.blogspot.com/

http://newhk.blogspot.com/

http://echkelon.blogspot.com/

[Bruce Chiles]

A partial return to the status quo ante bellum....

http://univercia.blogspot.com/

"Cacophonies of the New American KILLERS..."

http://americanassassination.blogspot.com/

http://elie-hobeika.blogspot.com/

http://wiredlebanon.blogspot.com/

http://phoeniciaphoenix.blogspot.com/

http://hobeika.blogspot.com/

http://hk-elie-hobeika.blogspot.com/

http://anaconda-manifesto.blogspot.com/

http://lebaneseresistance.blogspot.com/

http://newhk.blogspot.com/

http://echkelon.blogspot.com/