Zmutfx's ModelEditFix Trojan, pics inside.

[Froogle]

When I first downloaded it, nothing happened, but a few days and an Avast! update later I opened my model edit WoW folder and.....

"Win32:Runner-N [Trj]" has been found in "C:\World of Warcraft ME\ModelEditFix.exe" file.



Lots of others have been posting that it has a virus and this is MY proof that there is one, I had no paranoia there was one before this happened.

Then, I thought, "Maybe it gained the trojan later? Maybe my PC is infected?" so I went to the Model Edit Fix sticky and tried downloading it again. Results below:

[reflex0rzor]

if you read one of the other 20 topics on this you will know that it is not a trojan and if you want to be sure you can find the source and compile your own.

[Froogle]

Yes but I'm just refreshing the topic with more proof . . . I'm not going to use this until it shows clean in a later version.

[Teaparty]

Its just something that avast updated what makes modeledit fix look like a virus, as you can see the file is 3kb big, no real virus/keylogger could fit in that, ive never seen
modeleditfix trying to connect any internet service nor anyother service in my computer... this means it doesnt matter if it gets your password cause it has no way to send it forwards..

This is same as anti virus detects packet sniffers/ editors as a virus due to that they are able to do serious shit..

and as you can see from source code there is nothing "scary" in there

[Demonkunga]

As far as I've seen, only Avast gives this false posative. Dame good thing I don't use Avast anymore.

[JimbobGo]

Win32.Runner because its uses CreateProcess to execute the WoW client. No, it isn't a trojan. Reguardless of what any AV program says.

[Mercer]

i know this aint got a virus in it as iv used for ages and never got problem before, its only now my Avast has updated -.- need to find a way to solve this problem

[Mercer]

any1 know a thread you can send me to so i can see how i fix this problem so avast dont say its a trojan?

[Froogle]

Turn off resident scanner.

[Aqqu]

Avast and AVG also found "trojans and viruses" in blizzards own patches downloaded via the blizzard downloader, straight from blizzards pages, some time ago. It got fixed when blizzard contacted the companies and asked for a hotfix.

False positives FTL.

It's safe.

[Flying Piggy]

Its just something that avast updated what makes modeledit fix look like a virus, as you can see the file is 3kb big, no real virus/keylogger could fit in that, ive never seen
modeleditfix trying to connect any internet service nor anyother service in my computer... this means it doesnt matter if it gets your password cause it has no way to send it forwards..

This is same as anti virus detects packet sniffers/ editors as a virus due to that they are able to do serious shit..

and as you can see from source code there is nothing "scary" in there

I also ran some tests and it doesn't connect to the internet .

/closed