Trojans and backdoor [Archive]

it-pro-

1 Sep 2009, 14:36

Wormetti

1 Sep 2009, 16:55

You shouldn't believe everything your anti virus program tells you. They often report perfectly legit files as malware. Wormkit is safe.

MihaiS_v2

1 Sep 2009, 17:01

You registered to tell everyone how stupid you are?

robowurmz

1 Sep 2009, 17:08

For goodness sake you are so thick.

Seriously. Go get yourself a good virus scanner that won't pick up stupid false positives.

Lex

1 Sep 2009, 17:10

WormKit is entirely unrelated to Team17. Also, it is distributed with the full source code. You can see exactly what it does for yourself.

I hope you realize that WormKit modules are not Worms Armageddon updates.

CyberShadow

1 Sep 2009, 17:17

I do not understand why Team17's permit cybershadow to make these updates. Since they contain the trojoans and backdoor.

HookLib.dll Trojan.ATRAPS!IK, UnclassifiedMalware, Trojan.ATRAPS

madCHook.dll Suspicious, Backdoor/Huigezi.2007.agwr

wkPackets.dll Possible_Virus

WormKit.exe Trojan.ATRAPS!IK, Heur.Packed.Unknown, Trojan.ATRAPS
"My antivirus which I trust completely over anything else told me that WormKit is a virus. Therefore CyberShadow is a criminal and must be put to justice. I will also completely ignore the fact that WormKit is composed out of open-source code and a well-known commercial library (http://www.madshi.net/madCodeHookDescription.htm) used in hundreds of software products, because I'm probably a computer-illiterate prejudiced person".

:rolleyes:

pisto

1 Sep 2009, 17:20

lol.
lol.
lol.
(finally reached the 10 characters limit, is that a problem only for me?)

bonz

1 Sep 2009, 18:36

lol.
lol.
lol.
(finally reached the 10 characters limit, is that a problem only for me?)
Yes .

it-pro-

1 Sep 2009, 21:12

Maybe is Wormkit safe or cybershadow is just smart.

Hack by Entuser

wkPX.dll with Trojans
http://virscan.org/report/cfe30da83672017268d4ef7a8c3c42da.html

wkPX.dll without Trojans
http://virscan.org/report/3bef59bdb48a54dd249fcf5636f929f5.html

------------------------------------------------------------------------

Hack by Pisto - wa-hacks.exe and wkRubberWorm.dll have same features

wa-hacks.exe with Trojans
http://virscan.org/report/3986c000807c3232c4300212652c8201.html

wkRubberWorm.dll without Trojans
http://virscan.org/report/a241e5697943eccb6b4d70ea049bf3fc.html

wkCinusKick.dll with Trojans
http://virscan.org/report/6d7399c8f850bb27e7288e0a3a45193d.html

So Pisto why not make 1 witout Trojans.

------------------------------------------------------------------------

I hope your understand me - because not all trojans is fake!

raffie

1 Sep 2009, 21:30

sǝssnɹıʌ ɯɹoʍ ɥʇıʍ pǝʇɔǝɟuı sı ʎʇıunɯɯoɔ ǝɹıʇuǝ sıɥʇ

CyberShadow

1 Sep 2009, 22:05

You are free to believe whatever you want to believe. If you wanted to genuinely ask about the results of your virus scans, you could have made a polite inquiry without making blatant accusations based on your limited knowledge of computers.

The files you are scanning have code that may appear suspicious to heuristic (http://en.wikipedia.org/wiki/Heuristic_analysis) malware scanners. madCodeHook (the library used by WormKit) allows great flexibility of inter-operation with other applications and the operating system, and has often been misused by malware authors before madCodeHook became commercial. The very nature of most WormKit modules is to modify another program (Worms Armageddon) so that it behaves differently, which isn't too far off what evil computer viruses do.

I hope this will clear up any misconceptions you may have acquired from the false positives (http://www.google.com/search?q=virus+false+positive) in your scan. If you have any remaining doubts about WormKit, you can ask a programmer friend to examine the source code for any malicious code, recompile it, and check that the binary file won't be too different from what's in the .zip file.

P.S. I don't quite understand where did you get the "with- and without-trojan" versions of wkPX.dll.

MihaiS_v2

1 Sep 2009, 23:40

it-pro-, since you're so cool and think you've brought to the scene some breaking news, I suggest you run the malicious applications and modules within a virtual computer and analyze the actual damage. See if there are any illegal attempts to connect to unknown or suspicious resources on the Internet or if your files get corrupted or deleted. If so, please report back so people can hang CyberShadow in the town square.

Unless anti-virus reports tell you to kill your teachers, go learn proper English (before launching serious accusations), instead of wasting your time on forums making a fool of yourself (and feeling bad at night, even if none of us know who you are- not that anyone would give a damn).

I hope your understand me - because not all trojans is fake!

pisto

2 Sep 2009, 01:24

hello, I'm the author of RubberWorm and wa-hacks. And I have administrator privileges on your pc. I suggest you to hide better your porns directory.

lDarKl

2 Sep 2009, 02:02

This thread made me laugh really hard. Now my belly hurts.

it-pro-

2 Sep 2009, 08:36

robowurmz

2 Sep 2009, 09:53

hello, I'm the author of RubberWorm and wa-hacks. And I have administrator privileges on your pc. I suggest you to hide better your porns directory.

This made me laugh. :D

yakuza

2 Sep 2009, 10:15

there seem to be spartans in my wormkits

CyberShadow

2 Sep 2009, 10:32

Like you see, I have right. And I just wanna warning ppl, so they can decide what they want. And if you don´t like it, is not my problem. Like you see, they can make SAME program with and without Trojans. So don´t come and tell me this trojans is false.
Ok, I honestly tried, but at this point it just looks like you're trolling. If you're serious about your accusations, please answer my earlier question.

Edit: for the record, I scanned the latest version of wkPX.dll I got from http://worms-px.ru/ (website is down at the moment), with the same website as you did: http://virscan.org/report/edd05f0f840404e4be9d857250bc0d5b.html . This file is neither of the two you linked to, which further stresses my question.

Gnork

2 Sep 2009, 10:41

@ it-pro: IF you are really so worried about your system security. IF you are really so desperate to keep trojans and malware and spyware and badware and all other evil nasty **** OUT of your pc. Then tell me. WHY are you using some kind of cheap antivirus product which seems to give you that many false positives? What kind of crap antivirus are you using? A free one perhaps? Avast? AVG? That kinda CRAP? Please, go to the shop, spend some money on real software and get rid of your current protection, because it plainly SUX. ty.

CyberShadow

2 Sep 2009, 10:42

He's using an online scanner which scans files with an entire batch of antiviruses.

pisto

2 Sep 2009, 10:47

and he should notice that only 2-3 of them give that false positive.
www.av-comparatives.org is good to choose your new antivirus.

For record, also my AV (Avira Antivir free edition) is worried about Wormkit.exe

I find almost insulting, that after all the time I spent on RubberWorm, someone blames me and think I'm another virus writer kid.

the_nic

2 Sep 2009, 14:27

GreeN

2 Sep 2009, 14:37

It's the hair, pisto

Entuser

2 Sep 2009, 16:17

i'm sorry, but some old versions of PX really were infected with Induc.A virus. this virus infects Delphi's DCU files, and don't doing anything else. (i have caught "induc" from QIP program)

http://www.sophos.com/blogs/sophoslabs/v/post/6195

but Wormkit etc. isn't trojan, stop making threads about it

raffie

2 Sep 2009, 19:13

Well that shut everyone up. . .

pisto

2 Sep 2009, 20:07

:eek:
how it works! cool virus.
when was the problem? I once was infected by a very hard to remove virus, actually a rootkit, was it that?

anyway, my software is written in c/c++. So it's safe against that.

Lazure

3 Sep 2009, 00:08

SchemeWorks had been detected as clean for a long time, a program I use all the time to edit WA schemes, and suddenly Avast, AntiVir, etc are all detecting it as a trojan...

I know SchemeWorks can't possibly be a virus, considering so many people use it and I've had it there for YEARS.. but I can't even run it now without my virus scanners flippin out and trying to quarantine it.

CyberShadow

3 Sep 2009, 00:10

Perhaps the source of our woes is that our software is related to "computer worms" :)

Lazure

3 Sep 2009, 00:17

Heh, I went ahead and found a program called SchemeEddy, it looks more current and has more options anyways... and my Virus Scanners don't flip out. XD ...

robowurmz

3 Sep 2009, 09:38

Perhaps the source of our woes is that our software is related to "computer worms" :)

Anything with the word 'Worm' in it is being hit by heuristics. :P

Plasma

7 Sep 2009, 14:39

Perhaps the source of our woes is that our software is related to "computer worms" :)
CyberShdw, how many times have you made that joke since you joined the forum?

Etho.

7 Sep 2009, 17:46

Perhaps the source of our woes is that our software is related to "computer worms"

Sadly, I once got a minor computer virus for that very reason. I was searching for a copy of Worms World Party Aqua to download and I saw a site that had "wwp:a" and "worms" in its description. Right when I entered the site my desktop picture was switched with the blue screen of death. Then a link appeared that said they detected my computer had a virus (which they gave me) and that I needed to download their program to remove it (as if).

That was the last day I used Internet Explorer.

SgtFusion

8 Sep 2009, 08:34

What? Shouldn't it have been the last time you tried to download free full copies of copyrighted games?

robowurmz

8 Sep 2009, 10:36

Worms World Party Aqua was free, wasn't it?

yakuza

8 Sep 2009, 10:38

What? Shouldn't it have been the last time you tried to download free full copies of copyrighted games?

Yeah Etho, you should know better than to freely download freeware.

edit: damnit, beaten by a not-as-cool post.

SgtFusion

8 Sep 2009, 11:43

Ah, okay. I didn't know that.

Explorer

12 Sep 2009, 03:21

Pardon for interrupting, but
The files you are scanning have code that may appear suspicious to heuristic (http://en.wikipedia.org/wiki/Heuristic_analysis) malware scanners. madCodeHook (the library used by WormKit) allows great flexibility of inter-operation with other applications and the operating system, and has often been misused by malware authors before madCodeHook became commercial. The very nature of most WormKit modules is to modify another program (Worms Armageddon) so that it behaves differently, which isn't too far off what evil computer viruses do.
Cybershadow, I guess you'll need to mention this in your WormKit page (especially the "downloads (http://worms.thecybershadow.net/wormkit/#page2)" part), in order not to confuse anyone that WormKit is a virus.

GreeN

12 Sep 2009, 11:02

That's the first sensible suggestion in this thread

Gnork

12 Sep 2009, 15:55

That's the first sensible suggestion in this thread

I have another1: close it -.-

yakuza

12 Sep 2009, 18:06

Pardon for interrupting, but

Cybershadow, I guess you'll need to mention this in your WormKit page (especially the "downloads (http://worms.thecybershadow.net/wormkit/#page2)" part), in order not to confuse anyone that WormKit is a virus.

Or we could add a big banner on top of the main page that says "common sense people".

GreeN

13 Sep 2009, 00:12

Or we could add a big banner on top of the main page that says "common sense people".

If we wanted to mock those of a lower comprehension...

..Wait, never mind, I'd just be contradicting myself.

b1llygo4t

13 Sep 2009, 05:44

i say if your dumb enough to download something you obviously know little about, without doing ANY research, you deserve to think its malware, discontinue using it, and get flamed for being a noob.

lurk moar

Gatuno

8 Oct 2009, 15:01

OH MY GOD! OH MY GOD! my poor antivirus found 254 trojans and 147 Troia horses on wormkit! and more than 800 keyloggers! come on man stop wasting other people time, as Cybershadow said, you probally dont know anything about computers, hes a profissional known guy and could never put virus on games things, well me neither dont know alot about computers but enough to know that some configurations of programs should make "POOR ONLINE ANTI-VIRUS USED BY PEOPLE LIKE YOU" warn virus, but "your free to believe what you want to", if you really think the program was virus, simple delete it and keep crying about your infected computer... bye.

Morgoth

15 Oct 2009, 08:56

This thread was totally amusing. Thanks. By the way , itpro at least you dont have panda antivirus which doesn't allow s*** to pass through .
I think he is a troll (probably) .
Also, spoiler below ;

http://i42.photobucket.com/albums/e310/Morgoth_Bauglir/1255547496533.png

i<3worms:)

15 Oct 2009, 15:48

he must have gotten the virus from porn he downloaded and is blaming it on WormKit, lol at this thread :D :D

MihaiS_v2

15 Oct 2009, 17:21

Porn would be of no use to him.

Gnork

15 Oct 2009, 19:30

By the way , itpro at least you dont have panda antivirus which doesn't allow s*** to pass through .

yes it does, you only need to know how :p and for the less brighter people it blocks 'unknown threats' by default, yes... just the way it should be

Morgoth

15 Oct 2009, 20:41

yes it does, you only need to know how :p and for the less brighter people it blocks 'unknown threats' by default, yes... just the way it should be

There are people who don't need to waste an hour configuring something so simple. Anyway the thread is dead , I am sorry to be bumping this again. I shall let it die in peace.