EVE Search - evemon? trojan? false positive? really hope so

All Channels

EVE General Discussion

evemon? trojan? false positive? really hope so

» Click here to find additional results for this topic using Google

Monitor this thread via RSS [?]

Pages: [1] :: one page
Author	Thread Statistics \| Show CCP posts - 0 post(s)
End Yourself	Posted - 2006.07.01 22:15:00 - [1] just downloaded evemon from http://evemon.evercrest.com/downloads/EVEMon-install-1.0.25.0.exe for a mate his virusscanner found TR/Dldr.Zlob.VV.2 in the installer. even tho i think it might prolly be a false positive, i am not going to install this for now. really cant find anything about that trojan horse anywhere on the web. just other versions of Zlob. can the community pls doublecheck the file with whatever virus scanner you are using? six anari is offline atm sadly. :/ md5 of the file is 24cdcdacf469e29fbd5adf7ee0c34635 virusscanner used is antivir, engine 7.1.0.19, signature 6.35.0.129 --- Fighting for peace is like screwing for virginity.
Dark Shikari	Posted - 2006.07.01 22:19:00 - [2] Sounds like a crappy virusscan. Upload it to Kaspersky's website and test it: if there's no trojan with Kaspersky, there just isn't: its detection rate is over 99.8%. --Proud member of the [23]-- -WTB Platinum Technite, WTS Nanotransistors, Heavy Electron II, 100mn AB II-
bonombonom	Posted - 2006.07.01 22:21:00 - [3] I've scanned it 3 times on both my computers, in different ways, all of the scans found nothing.
End Yourself	Posted - 2006.07.01 22:26:00 - [4] Originally by: bonombonom I've scanned it 3 times on both my computers, in different ways, all of the scans found nothing. could you pls check if its exactly the same file for me? will drive home now, then see what to do --- Fighting for peace is like screwing for virginity.
Verone	Posted - 2006.07.01 22:26:00 - [5] Originally by: Dark Shikari Sounds like a crappy virusscan. Upload it to Kaspersky's website and test it: if there's no trojan with Kaspersky, there just isn't: its detection rate is over 99.8%. I tried this when I first started using it, It's clean as a whistle. VETO RECRUITMENT
End Yourself	Posted - 2006.07.01 22:31:00 - [6] Originally by: Dark Shikari Sounds like a crappy virusscan. Upload it to Kaspersky's website and test it: if there's no trojan with Kaspersky, there just isn't: its detection rate is over 99.8%. well 99.8% != 100% and not beeing able to find ANYTHING AT ALL about that trojan horse on the internet somehow tells me its a rather new one. even the av vendor itself doesnt have it in his database(yet) --- Fighting for peace is like screwing for virginity.
Tarnish Katharr	Posted - 2006.07.01 22:37:00 - [7] Its highly unlikely that evemon has anything like in it. Six Anari is a standup guy and there are thousands of people now using Evemon that haven't reported any trouble. If you want to, you can even download the source to the program and build it yourself. Be nice if Six would give us an update though, haven't heard from him in a while now. ------------------- Stop whining!
Elissen	Posted - 2006.07.01 22:40:00 - [8] Quote: //----------------------------------------------------------------- // //Product: BitDefender 9 Standard //Version: 9.5 // //Created on:02/07/200600:27:33 // //----------------------------------------------------------------- Statistics Scan path: Z:\EVEMon-install-1.0.25.0.exe Folders: 0 Files: 4 Archives: 2 Packed files: 0 Identified viruses: 0 Infected files: 0 Warnings: 0 Suspect files: 0 Disinfected files: 0 Deleted files: 0 Copied files: 0 Moved files: 0 Renamed files: 0 I/O errors: 0 Scan time: 00:00:02 Scan speed (files/sec): 2 Virus definitions: 428515 Scan plugins: 15 Archive plugins: 42 Unpack plugins: 5 Mail plugins: 6 System plugins: 5 Scan options Detection [ ] Scan boot sectors [X] Scan archives [X] Scan packed files [X] Scan email File mask [ ] Programs [X] All files [ ] User defined extensions: [ ] Exclude extensions: ; Action Infected objects [ ] Ignore [X] Disinfect [ ] Delete [ ] Copy to quarantine [ ] Move to quarantine [ ] Rename [ ] Prompt user Second action [ ] Ignore [ ] Delete [ ] Copy to quarantine [X] Move to quarantine [ ] Rename [ ] Prompt user Scan options [X] Enable warnings [X] Enable heuristics [X] Show all files in log [X] Report file: E:\Program Files\Softwin\BitDefender8\Logs\vscan_1151792853.log Scanned files Z:\EVEMon-install-1.0.25.0.exeOK Z:\EVEMon-install-1.0.25.0.exe=>(NSIS o)OK Z:\EVEMon-install-1.0.25.0.exe=>(NSIS o)=>%INSTALLSCRIPT%OK Z:\EVEMon-install-1.0.25.0.exe=>(NSIS o)=>zlib_nsis0001OK and: 24cdcdacf469e29fbd5adf7ee0c34635 EVEMon-install-1.0.25.0.exe also ran the file trough virusscan.jotti.org: Quote: File: EVEMon-install-1.0.25.0.exe Status: POSSIBLY INFECTED/MALWARE (Note: this file was only classified as malware by scanners known to generate more false positives than the average scanner. Do not consider these results definately accurate. Also, because of this, results of this scan will not be recorded in the database.) MD5 24cdcdacf469e29fbd5adf7ee0c34635 Packers detected: - Scanner results AntiVir Found Trojan/Dldr.Zlob.VV.2 ArcaVir Found nothing Avast Found nothing AVG Antivirus Found nothing BitDefender Found nothing ClamAV Found nothing Dr.Web Found nothing F-Prot AntivirusFound nothing Fortinet Found nothing Kaspersky Anti-Virus Found nothing NOD32 Found nothing Norman Virus Control Found nothing UNA Found nothing VirusBuster Found nothing VBA32 Found nothing probaly a false prositive ---- ICSC Jumpplanner tool - Routeplanner for all jumpcapable ships!
Maxlis	Posted - 2006.07.01 22:46:00 - [9] Originally by: Tarnish Katharr Its highly unlikely that evemon has anything like in it. Six Anari is a standup guy and there are thousands of people now using Evemon that haven't reported any trouble. If you want to, you can even download the source to the program and build it yourself. Be nice if Six would give us an update though, haven't heard from him in a while now. Tim Fries (Six Anari) is a really good standup guy. I've been on his forums for over 4 years now, almost 5. I've also been using EvE Mon since shortly after he released it. There's no virus or trojan or whatever. You've just got a bum scanner.
End Yourself	Posted - 2006.07.01 22:50:00 - [10] Originally by: Tarnish Katharr Its highly unlikely that evemon has anything like in it. Six Anari is a standup guy and there are thousands of people now using Evemon that haven't reported any trouble. If you want to, you can even download the source to the program and build it yourself. Be nice if Six would give us an update though, haven't heard from him in a while now. i mailed six before posting this, couldnt get hold of him. i never meant to blame him, didnt have any problems myself for a long time. and even tho i dont know him personally i dont think he'd do it. simply makes no sense because it would be very easy to get hold of his rl identity. BUT might as well be someone else who "managed to" replace the file on the webserver. and might have been just replaced few hours/minutes ago so noone could have reported it yet. well im home now and will install the evemon in a vm and see what happens --- Fighting for peace is like screwing for virginity.
End Yourself	Posted - 2006.07.01 22:56:00 - [11] Originally by: Maxlis Originally by: Tarnish Katharr Its highly unlikely that evemon has anything like in it. Six Anari is a standup guy and there are thousands of people now using Evemon that haven't reported any trouble. If you want to, you can even download the source to the program and build it yourself. Be nice if Six would give us an update though, haven't heard from him in a while now. Tim Fries (Six Anari) is a really good standup guy. I've been on his forums for over 4 years now, almost 5. I've also been using EvE Mon since shortly after he released it. There's no virus or trojan or whatever. You've just got a bum scanner. i NEVER EVER blamed six. some random pimpled 15 yo might have replaced the file --- Fighting for peace is like screwing for virginity.
Piter Blake	Posted - 2006.07.01 23:16:00 - [12] Edited by: Piter Blake on 01/07/2006 23:22:38 I started some time ago a monitoring of evemon not because I think it has a trojan but because I like to know what the program I do install are actually doing. Only connection outside eve-online.com while evemone (and only evemon) is running. (for those that can't read, it's a connection to the evemon website to check for updates) Yet, I still have to fire ida pro but I prefere to fire the eve online client I honestly do not think this program has a trojan. Take my post for what its worth. Only my humble opinion. ;) -- Quis est Rex Gloria ?
Hllaxiu	Posted - 2006.07.02 00:25:00 - [13] If you're going to be paranoid, you could always download the source from SVN and build it yourself. --- Our greatest glory is not in never failing, but in rising up every time we fail. - Emerson
Miganto	Posted - 2006.07.02 02:05:00 - [14] just to let you know, i got the same warning with antivir too. May just be the program rather than evemon :)
Taiamat	Posted - 2006.07.02 06:15:00 - [15] Looking at the results from the posted scans, all that is getting flagged is certain behaviors of evemon's programming are similar to a peice of malware in terms of its reading and handling of data. You could get the same results off of winamp, or the SETI client. Its no virus, it just causes a red flag by antiviral software looking for specific behavior.
iqplayer	Posted - 2006.07.02 13:18:00 - [16] Unfortunately, this is the limitation of automated Anti Virus software. The AV software can either scan from a list of preknown viruses, in which case it will not detect any virus that's been released since the last update (and leaving you vulnerable to very new and quickly spreading viruses); or they can also scan for 'virus like' behavior - which tends to generate as many false positives as it does reliable warnings. The fact that the 'infection' wasn't even listed yet in your antivirus program's database gives you a valuable hint as to which method is flagging this file. From the information that's been posted so far though, you may want to do some more research into AV programs, as it seems there's some concerns about the one your using. When all is said and done though, caution is always a good policy.
HippoKing	Posted - 2006.07.02 13:21:00 - [17] You're clean! Kaspersky Anti-Virus has not detected any viruses at this time in the file you submitted. Scanned file: EVEMon-install-1.0.25.0.exe EVEMon-install-1.0.25.0.exe/data0001 - OK EVEMon-install-1.0.25.0.exe/data0002 - OK EVEMon-install-1.0.25.0.exe/data0003 - OK EVEMon-install-1.0.25.0.exe/data0004 - OK EVEMon-install-1.0.25.0.exe/data0005 - OK EVEMon-install-1.0.25.0.exe/data0006 - OK EVEMon-install-1.0.25.0.exe/data0007 - OK EVEMon-install-1.0.25.0.exe/data0008 - OK EVEMon-install-1.0.25.0.exe/data0009 - OK EVEMon-install-1.0.25.0.exe/data0010 - OK EVEMon-install-1.0.25.0.exe/data0011 - OK EVEMon-install-1.0.25.0.exe/data0012 - OK EVEMon-install-1.0.25.0.exe/data0013 - OK EVEMon-install-1.0.25.0.exe/data0014 - OK EVEMon-install-1.0.25.0.exe/data0015 - OK EVEMon-install-1.0.25.0.exe/data0016 - OK EVEMon-install-1.0.25.0.exe/data0017 - OK EVEMon-install-1.0.25.0.exe/data0018 - OK EVEMon-install-1.0.25.0.exe/data0019 - OK EVEMon-install-1.0.25.0.exe/data0020 - OK EVEMon-install-1.0.25.0.exe/data0021 - OK EVEMon-install-1.0.25.0.exe/data0022 - OK EVEMon-install-1.0.25.0.exe/data0023 - OK EVEMon-install-1.0.25.0.exe/data0024 - OK EVEMon-install-1.0.25.0.exe/data0025 - OK EVEMon-install-1.0.25.0.exe/data0026 - OK EVEMon-install-1.0.25.0.exe/data0027 - OK
Scorpyn	Posted - 2006.07.02 13:30:00 - [18] Nothing wrong with it according to F-Secure.
Kael D'mende	Posted - 2006.07.02 14:35:00 - [19] AVG find nothing either, the problem with vira is that they spread on your harddrive, so it could have had a different source to start with, just my 2 cent.. and yes if evemon really was infected, if would lose its sticky and proberly get looked at by ccp i imagine ;o) Regards. /Kael
Drizit	Posted - 2006.07.02 15:00:00 - [20] McAfee AV reports nothing either. --
Talori'i	Posted - 2006.07.02 16:27:00 - [21] AntiVir has given me a bunch of false positives recently. On things that I know are not infected. Its a nice Antivirus but it isn't perfect. 4 8 15 16 23 42
Rycka LDK	Posted - 2006.07.24 08:19:00 - [22] //Product: BitDefender 9 Professional Plus //Version: 9.5 //Created on:24/07/200611:01:32 Virus Statistics Scan path: EVEMon-install-1.0.25.0.exe Folders: 0 Files: 34 Archives: 4 Packed files: 0 Identified viruses: 0 Infected files: 0 Warnings: 0 Suspect files: 0 Disinfected files: 0 Deleted files: 0 Copied files: 0 Moved files: 0 Renamed files: 0 I/O errors: 0 Scan time: 00:00:03 Scan speed (files/sec): 11 Virus definitions: 444156 Scan plugins: 15 Archive plugins: 42 Unpack plugins: 5 Mail plugins: 6 System plugins: 5 Virus scan options Detection [ ] Scan boot sectors [X] Scan archives [X] Scan packed files [X] Scan email File mask [ ] Programs [X] All files [ ] User defined extensions: [ ] Exclude extensions: ; Action Infected objects [ ] Ignore [X] Disinfect [ ] Delete [ ] Copy to quarantine [ ] Move to quarantine [ ] Rename [ ] Prompt user Second action [ ] Ignore [ ] Delete [ ] Copy to quarantine [X] Move to quarantine [ ] Rename [ ] Prompt user Virus scan options [X] Enable warnings [X] Enable heuristics [X] Show all files in log [X] Report file: C:\Program Files\Softwin\BitDefender9\Logs\vscan_1153728092.log Scanned files C:\Documents and Settings\user\Desktop\EVEMon-install-1.0.25.0.exeOK C:\Documents and Settings\user\Desktop\EVEMon-install-1.0.25.0.exe=>(NSIS o)OK C:\Documents and Settings\user\Desktop\EVEMon-install-1.0.25.0.exe=>(NSIS o)=>%INSTALLSCRIPT%OK C:\Documents and Settings\user\Desktop\EVEMon-install-1.0.25.0.exe=>(NSIS o)=>zlib_nsis0001OK C:\Documents and Settings\user\Desktop\EVEMon-install-1.0.25.0.exe=>(NSIS o)=>zlib_nsis0002OK C:\Documents and Settings\user\Desktop\EVEMon-install-1.0.25.0.exe=>(NSIS o)=>zlib_nsis0003OK C:\Documents and Settings\user\Desktop\EVEMon-install-1.0.25.0.exe=>(NSIS o)=>zlib_nsis0004OK C:\Documents and Settings\user\Desktop\EVEMon-install-1.0.25.0.exe=>(NSIS o)=>zlib_nsis0005OK C:\Documents and Settings\user\Desktop\EVEMon-install-1.0.25.0.exe=>(NSIS o)=>zlib_nsis0006OK C:\Documents and Settings\user\Desktop\EVEMon-install-1.0.25.0.exe=>(NSIS o)=>zlib_nsis0007OK C:\Documents and Settings\user\Desktop\EVEMon-install-1.0.25.0.exe=>(NSIS o)=>zlib_nsis0008OK C:\Documents and Settings\user\Desktop\EVEMon-install-1.0.25.0.exe=>(NSIS o)=>zlib_nsis0009OK C:\Documents and Settings\user\Desktop\EVEMon-install-1.0.25.0.exe=>(NSIS o)=>zlib_nsis0010OK C:\Documents and Settings\user\Desktop\EVEMon-install-1.0.25.0.exe=>(NSIS o)=>zlib_nsis0011OK C:\Documents and Settings\user\Desktop\EVEMon-install-1.0.25.0.exe=>(NSIS o)=>zlib_nsis0012OK C:\Documents and Settings\user\Desktop\EVEMon-install-1.0.25.0.exe=>(NSIS o)=>zlib_nsis0013OK C:\Documents and Settings\user\Desktop\EVEMon-install-1.0.25.0.exe=>(NSIS o)=>zlib_nsis0014OK C:\Documents and Settings\user\Desktop\EVEMon-install-1.0.25.0.exe=>(NSIS o)=>zlib_nsis0015OK C:\Documents and Settings\user\Desktop\EVEMon-install-1.0.25.0.exe=>(NSIS o)=>zlib_nsis0016OK C:\Documents and Settings\user\Desktop\EVEMon-install-1.0.25.0.exe=>(NSIS o)=>zlib_nsis0017OK C:\Documents and Settings\user\Desktop\EVEMon-install-1.0.25.0.exe=>(NSIS o)=>zlib_nsis0018OK C:\Documents and Settings\user\Desktop\EVEMon-install-1.0.25.0.exe=>(NSIS o)=>zlib_nsis0019OK C:\Documents and Settings\user\Desktop\EVEMon-install-1.0.25.0.exe=>(NSIS o)=>zlib_nsis0020OK C:\Documents and Settings\user\Desktop\EVEMon-install-1.0.25.0.exe=>(NSIS o)=>zlib_nsis0021OK C:\Documents and Settings\user\Desktop\EVEMon-install-1.0.25.0.exe=>(NSIS o)=>zlib_nsis0022OK C:\Documents and Settings\user\Desktop\EVEMon-install-1.0.25.0.exe=>(NSIS o)=>zlib_nsis0023OK C:\Documents and Settings\user\Desktop\EVEMon-install-1.0.25.0.exe=>(NSIS o)=>zlib_nsis0024OK C:\Documents and Settings\user\Desktop\EVEMon-install-1.0.25.0.exe=>(NSIS o)=>zlib_nsis0025OK
Wolfmoon	Posted - 2006.07.25 21:09:00 - [23] While I could not find any viruses using a couple different scanners, I have something else more worrying to report. I installed evemon to use an an alternate account, logged in, got my characters info. No prob there, nice program. However, for the next several hours I was continually kicked off the server. This kept on happening until I changed my password, and haven't been kicked since. Too coincidental for me. This didn't happen until I logged in with Evemon to get my character info, and it stopped after I changed the password on that account. I'm not going to search through the code to see where the login info might be getting sent off to, I just un installed it and won't ever again bother with 3rd party programs, unless I happen to write my own. Just a warning to you all, WATCH out!
Mithrantir Ob'lontra Gallente	Posted - 2006.07.25 21:22:00 - [24] Originally by: Scorpyn Nothing wrong with it according to F-Secure. According to my F-Secure (Karpesky Engine for someone who will doubt its capabilities) it did found a very suspicious file (malware i don't remember the name since i am not at home now). Which file was not installed in the EveMon folder and i quarantine it. EveMon works fine without this, so i guess that someone has tampered the files on certain servers. ------- Nobody can be exactly like me. Even I have trouble doing it.
Maxlis Caldari	Posted - 2006.07.25 22:15:00 - [25] Originally by: Wolfmoon While I could not find any viruses using a couple different scanners, I have something else more worrying to report. I installed evemon to use an an alternate account, logged in, got my characters info. No prob there, nice program. However, for the next several hours I was continually kicked off the server. This kept on happening until I changed my password, and haven't been kicked since. Too coincidental for me. This didn't happen until I logged in with Evemon to get my character info, and it stopped after I changed the password on that account. I'm not going to search through the code to see where the login info might be getting sent off to, I just un installed it and won't ever again bother with 3rd party programs, unless I happen to write my own. Just a warning to you all, WATCH out! You could always use the option to manually download the XML info for EvEMON yourself. That's all it uses your login info for. I've had zero issues with my accounts or with EvEMON. It's a very handy piece of software.
Tribal Queen	Posted - 2006.11.09 13:19:00 - [26] Edited by: Tribal Queen on 09/11/2006 13:20:16 It is not working for me.Below is the error message. System.NullReferenceException: Object reference not set to an instance of an object. at EVEMon.Common.EveSession.ProcessCharacterXml(XmlDocument xdoc, Int32 characterId, Int32& cacheExpires) in C:\Documents and Settings\Tim Fries\Desktop\EveCharacterMonitor\EVEMon.Common\EveSession.cs:line 155 at EVEMon.Common.EveSession.UpdateGrandCharacterInfo(GrandCharacterInfo grandCharacterInfo, Control invokeControl) in C:\Documents and Settings\Tim Fries\Desktop\EveCharacterMonitor\EVEMon.Common\EveSession.cs:line 658 at EVEMon.Common.EveSession.<>c__DisplayClass9.<UpdateGrandCharacterInfoAsync>b__8(Object ) in C:\Documents and Settings\Tim Fries\Desktop\EveCharacterMonitor\EVEMon.Common\EveSession.cs:line 598 at System.Threading._ThreadPoolWaitCallback.WaitCallback_Context(Object state) at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state) at System.Threading._ThreadPoolWaitCallback.PerformWaitCallback(Object state)
Anders Chydenius Phoenix Industries	Posted - 2006.11.09 13:48:00 - [27] Have you thought about downloading the latest version? It's all over the real evemon thread in the skills channel. ------ {o,o} (__(\| -"-"- EVEMon

Pages: [1] :: one page
First page \| Previous page \| Next page \| Last page

COPYRIGHT NOTICE
EVE Online, the EVE logo, EVE and all associated logos and designs are the intellectual property of CCP hf. All artwork, screenshots, characters, vehicles, storylines, world facts or other recognizable features of the intellectual property relating to these trademarks are likewise the intellectual property of CCP hf. EVE Online and the EVE logo are the registered trademarks of CCP hf. All rights are reserved worldwide. All other trademarks are the property of their respective owners. CCP hf. has granted permission to EVE-Search.com to use EVE Online and all associated logos and designs for promotional and information purposes on its website but does not endorse, and is not in any way affiliated with, EVE-Search.com. CCP is in no way responsible for the content on or functioning of this website, nor can it be liable for any damage arising from the use of this website.