Wormkit with a virus???

[Drc]

can anyone tell me why when i try to play worms by using wormkit my antivirus (avira) says something like this:

C.\MicroProse\Worms Armageddon\Wormkit.exe
contains recognition pattern of the DR/Delphi.Gen dropper

[yakuza]

Because your antivirus is wrong.

[pisto]

keep it, it's safe.

your AV recognizes some techniques that might be used by viruses too, by wormkit isn't a virus actually.

[bonz]

Because your antivirus is wrong.
Nope, not necessarily.
IIRC, CyberShadow once said that the madchook library he uses in WormKit is also often used by virus creators.

[franpa]

My virus scanner goes off about it too, it detects the zip as suspicious (using heurustics) and when decompressed it detect'd one of the files as a potential virus. none of it was concrete since it was just heurustics though so yeah it should be safe :P

[pisto]

you can check what wormkit does in the sources. and it's only a bunch of lines.

[franpa]

Most will still be using blind faith, not all of us know how to compile and verify it works (in case the compiled build was done from a different source ;)) and not many of us can read code.

[Drc]

i just deleted and downloaded again from cybershadow site and now my antivirus doesn't says anything :D

[franpa]

did you "update" your virus scanner since it was first detected as a virus? :)

[Drc]

did you "update" your virus scanner since it was first detected as a virus? :)

sure i did that...

now my antivirus says that wormkit.VIR its the virus....i deleted the file and wormkit still works

i don't get how its possivel

[CyberShadow]

Your antivirus probably earlier renamed WormKit.exe to WormKit.VIR, and now found the renamed file.

[Drc]

Your antivirus probably earlier renamed WormKit.exe to WormKit.VIR, and now found the renamed file.

so i don't need to worry right??? its not a virus

[CyberShadow]

Correct .

[Drc]

its not wormkit that is infected but rubberworm...my antivirus deleted all files that i had in my laptop that had rubberworm...

when i download rubberworm wormkit was included thats why my antivirus said that was infected but the real problem its rubberworm

[GreeN]

I would call it more of a culprit, than a problem.

[franpa]

for me, it is a part of WormNAT2 that is being falsely detected :/ wkpackets.dll

[Gnork]

Get yourself a REAL antivirus and stop whining about false alerts: http://www.pandasecurity.com/usa/homeusers/solutions/internet-security/

[CyberShadow]

VirusTotal (http://www.virustotal.com/analisis/5df76a5efa5d72d63d42b9e89c349235) says Panda considers wormkit.zip (same as the one from the website plus wkRubberWorm) a "suspicious file".

[Gnork]

VirusTotal (http://www.virustotal.com/analisis/5df76a5efa5d72d63d42b9e89c349235) says Panda considers wormkit.zip (same as the one from the website plus wkRubberWorm) a "suspicious file".

This happens only when heuristic scanning is enabled, though. Panda is by default configured to perform heuristic internetscans, but not on local files. And, since wormkit uses techniques which are similar to those used by some virusses, it will/should/must trigger with heuristic mode enabled. ONLY telling it's suspicious what wormkit.exe is up to, but there is NO virusname attached to the message, since it's no virus ;) Any scanner telling you its BlasterMasterW98.trojan.crap would be wrong.


Firefox will tell me the download has failed and leave a .part file, but the wormkit.zip is still created on the desktop, without problems. and - edit: on a second download try, panda isn't whining at all anymore about wormkit.zip ... maybe it learns from what it encountered a few seconds ago?

Conclusion: is very likely to get a warning message and perhaps not even a chance to download the file. For most people it's a pain in the bleep to configure their antivirus that such things don't happen. While heuristic scan is kinda very important as well nowadays. Cyber, if various antivirus programs do not like the way wormkit acts, isn't it a good idea to see how you can change the program so that it will act less like a virus?

[CyberShadow]

Sounds like a waste of time to me for the few paranoid-antivirus users out there...

[bonz]

IIRC, it's the MadHook library that CyberShadow has used with Wormkit. Sadly, also virus programmers use it.

Am I right to assume that you used it because it's free/non-commercial?

[Muzer]

No, I think it's commercial. It isn't opensource at least.

[Gnork]

Sounds like a waste of time to me for the few paranoid-antivirus users out there...

huahwhauwhuhaw actually, yes, you're right ;) hahahhuhwuhuahwuhaw

[StoneFrog]

Some Antivirus programs' "revolutionary worm and spyware detection" is nothing more than looking for certain words in the file name. :\

Try disabling your Antivirus, downloading Wormkit, renaming it? Then enable it again and see if it can tell.

[Herc]

Get yourself a REAL antivirus and stop whining about false alerts: http://www.pandasecurity.com/usa/homeusers/solutions/internet-security/

Eset's NOD32 is also good (and light) as it is written in assembly and C.Of course,you should not avoid using heuristics or if it detects it as a virus try to put it in an excluded scan list(guess other AVs will also have taht option too :-P).

[franpa]

Of course I am fully aware my virus scanner only suspects A virus, it has never shown an actual virus name... it actually shows a message saying that a "suspicious" file was quarentined.

It is not the madchook.dll library, I can scan that a million times without triggering any warnings.

[Drc]

TR/ATRAPS.Gen' [trojan]

this is what my antivirus says when i donwload wormkit from the website

[MihaiS]

TR/ATRAPS.Gen' [trojan]

this is what my antivirus says when i donwload wormkit from the website

My anti-virus says that Wormkit can kill my family and rape my English teacher.

Isn't it obvious by now that Wormkit can put your computer's integrity at risk?

[bonz]

Yes, you're risking endless hours of fun with the additional content in the form of wK modules.
:eek::eek::eek::eek::eek:

[Shirdel]

I have NOD32, and there's no problems with WormKit whatsoever.
But.. That's probably for 2 reasons.
1. I only have WormNAT2 in my WormKitModules folder. (In general)
2. NOD32's ran out. :S