Trojan Spy

Welcome, Guest. Please login or register.

[CJ]

Hi

While doing a scan of my computer, PC Tools anti-virus came up with a message that I have a mutant trojan-spy.ardamax.n in the following files of Ship Simulator 2008:
shipsim2008.exe
shipsimeditor.exe
startmenu.exe
uninstall.exe
unregister.exe
un_editor.exe


The fact that it is only in the above files and not anywhere else on my computer made me wonder (before reinstalling the game) whether it is something to do with Ship Simulator and not a trojan at all, but rather assumed by PC Tools to be the mutant because of its structure/behaviour. Comment?

[TerryRussell]

Hi.

AVG had a rogue edition some months ago that incorrectly thought Ship Simulator was a virus and helpfully deleted it. AVG fixed the poblem pretty quickly.

It's possible that your system is infected and it's possible that PCTools has a problem. (I didn't know PCTools still existed!).

(1)
Update PCTools and try again.

(2)
Install a free one, such as AVG and see what that says. If both claim "virus", then you are indeed infected. If not, speak to PCTools.

I'm assuming your version of PCTools is up to date, of course.


I'll move this to "General Discussions". That way, you're more likely to get feedback from others. That may be useful.

[kuusuru]

I didn't know PCTools still existed!

Indeed, it's nearly 20 years since I last used something going by that name (and we did use it for antivirus, disinfecting the (c)Brain virus by manually writing null characters over the virus code in the boot sector).

But it appears that there is a new PC Tools, and it's even endorsed by Dr Phil!
http://www.pctools.com/ (http://www.pctools.com/)

 

[TerryRussell]

I used to love that program. PCTools 5.5 was the last version I had. I still have the 5.25" floppies for it. Good old DOS days. 

Was it that long ago? Oh dear. Seems like yesterday.

PC-Net give it a good review (the new version), so I may take a look at it when I have some spare time.

[CJ]

The Spy actually occurs in Ship Simulator 2008. My 2006 was is not affected. 

I use PC Tools Anti-virus free version. The only paid PC Tools programme I use is Registry Mechanic.

I will try Kaspersky, download the free version, take the files out of quarantine and see what happens. Thanks for the interest. 

[The Captain]

More than once, I have also encoutered a "Dangerous" virus with SS08. Multiple times it has been associated with Ship simulator, and no where else has this dangerous virus been detected. I have no adware, and it is always up to date. The virus was related to "Cool web search" which I've never heard of, but apperently SS uses it.

[TerryRussell]

No it doesn't.

If you have it, then you have some other problem. It's probably a false detection.

Think about it. If it was truly in Ship Simulator 2008, there would be thousands of people screaming about it.

[CJ]

I am downloading Kasperky now (God it takes forever ). Then we will see.
The fact that six exe files are showing infection, including startup.exe, seems to suggest an infection

Think about it. If it was truly in Ship Simulator 2008, there would be thousands of people screaming about it.

Maybe if this was transferred to 2008 general discussions, more people would pick it up? 

[CJ]

Ok Kaspersky didn't pick up a thing. So it's something PC Tools picked up - false positive. 

[TerryRussell]

I expect that it (like AVG) was simply scanning for a sequence of bytes, and it found them somewhere.

PCTools should have a method for you to report false positives. If you do that, it may be helpful to them. Sometimes the suppliers of these programs reward people with an extra month's use or something (not always, though), so it's worth the couple of minutes it should take you.

Glad it's all sorted.

[thassos]

Maybe stating the obvious but are you sure that you only have one anti-virus program running?  I don't know if it is only with Vista but certainly, with that, more than one anti-virus application operating often throws up bogus "finds"