topbanner_forum
  *

avatar image

Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
  • Monday December 16, 2024, 3:00 am
  • Proudly celebrating 15+ years online.
  • Donate now to become a lifetime supporting member of the site and get a non-expiring license key for all of our programs.
  • donate

Author Topic: A Trojan in "Captain.exe" ?!  (Read 11366 times)

beslam

  • Participant
  • Joined in 2010
  • *
  • Posts: 16
    • View Profile
    • Donate to Member
A Trojan in "Captain.exe" ?!
« on: April 29, 2010, 11:36 AM »
Hello,
I analyzed Captain.exe with VirusTotal ( www.virustotal.com ) with 40+ different antivirus and I got as a result that a trojan named "Trojan.Win32.Swisyn.spa" infect Captain.exe  :huh:
Can everyone tell me anything about this, please ?!
Thanx.

mouser

  • First Author
  • Administrator
  • Joined in 2005
  • *****
  • Posts: 40,915
    • View Profile
    • Mouser's Software Zone on DonationCoder.com
    • Read more about this member.
    • Donate to Member
Re: A Trojan in "Captain.exe" ?!
« Reply #1 on: April 29, 2010, 11:46 AM »
two questions:

1) where is captain.exe from and what is it?
2) can you give us the url virustotal gives you where it displays its report so we can see?

beslam

  • Participant
  • Joined in 2010
  • *
  • Posts: 16
    • View Profile
    • Donate to Member
Re: A Trojan in "Captain.exe" ?!
« Reply #2 on: April 29, 2010, 11:58 AM »
1/ I doawnloaded captain.exe from https://www.donation...l/index.html#Captain

2/ The adress of the report of virustotal :
http://www.virustota...3f9f25b1d-1268877433

mouser

  • First Author
  • Administrator
  • Joined in 2005
  • *****
  • Posts: 40,915
    • View Profile
    • Mouser's Software Zone on DonationCoder.com
    • Read more about this member.
    • Donate to Member
Re: A Trojan in "Captain.exe" ?!
« Reply #3 on: April 29, 2010, 12:08 PM »
ok, thank you.

  • this is almost certainly a false positive, triggered not too unfrequently on compiled scripts written in the autohotkey language.  there is no virus or trojan.  it's a false alarm.
  • you can download the source .ahk file from that same page and run it without it being compiled at all, if you are wary.
  • usually we see only 1 stupid antivirus program flagging a compiled ahk as dangerous.. this time its a ton of them.. i suspect that it's because skrommel has build these so long ago.  it's DEEPLY troubling and fills me with anger at these antivirus companies for being so damn stupid and lazy to do this.  i simply can't express how irresponsible it is for them to generically flag programs as viruses just because they were compiled with a certain packaging program.  but i've ranted against this for so long in so many posts i'm just exhausted from it.
  • i will try to get skrommel to rebuild his ahks so these alerts stop.

mouser

  • First Author
  • Administrator
  • Joined in 2005
  • *****
  • Posts: 40,915
    • View Profile
    • Mouser's Software Zone on DonationCoder.com
    • Read more about this member.
    • Donate to Member
Re: A Trojan in "Captain.exe" ?!
« Reply #4 on: April 29, 2010, 12:17 PM »
follow up:
we need to fix skrommels compiled ahks and remove the upx right away, if there are this many antivirus tools falsely flagging these, this just confirms that the antivirus companies have effectively made it impossible to ever use UPX to pack anything again.  i feel horribly for UPX because this is deeply unfair to them, but as i said in this post, it is simply impossible to use UPX without getting massively and repeatedly flagged improperly as being a trojan -- there is no other solution at this point but to absolutely forbid the use of upx on any program uploaded to DC.

anyone associated with UPX who wants my help fighting the antivirus companies to get them to stop this outrageous (and perhaps legally liable for damages) behavior, just ask.  but until they do stop, we have no choice but to outlaw the use of upx on any dc related software, immediately.  the damage to the site is just too high.

beslam

  • Participant
  • Joined in 2010
  • *
  • Posts: 16
    • View Profile
    • Donate to Member
Re: A Trojan in "Captain.exe" ?!
« Reply #5 on: April 29, 2010, 12:47 PM »
Ok, I'm relieved  ;) but I have a couple of questions :

1) What do you mean with "DC" ?

2)Untill today, has anybody get some problem using it? Nobody before me complains about it, please?  :tellme:

Thanx



mouser

  • First Author
  • Administrator
  • Joined in 2005
  • *****
  • Posts: 40,915
    • View Profile
    • Mouser's Software Zone on DonationCoder.com
    • Read more about this member.
    • Donate to Member
Re: A Trojan in "Captain.exe" ?!
« Reply #6 on: April 29, 2010, 12:52 PM »
1) DC = DonationCoder

2) We *regularly* see these false-positive reports about compiled ahk scripts like skrommel's.  They are always false alarms.  You can see more here.

3) Such false alarms are why we established a new policy of saying the UPX packager should no longer be used on any programs uploaded to donationcoder.  it's just that skrommel has not updated his older exe's yet.  i hope he will do so right away.


beslam

  • Participant
  • Joined in 2010
  • *
  • Posts: 16
    • View Profile
    • Donate to Member
Re: A Trojan in "Captain.exe" ?!
« Reply #7 on: April 29, 2010, 01:06 PM »
 :Thmbsup:

lanux128

  • Global Moderator
  • Joined in 2005
  • *****
  • Posts: 6,277
    • View Profile
    • Donate to Member
Re: A Trojan in "Captain.exe" ?!
« Reply #8 on: May 26, 2010, 12:34 AM »
1/ I doawnloaded captain.exe from https://www.donation...l/index.html#Captain

2/ The adress of the report of virustotal :
http://www.virustota...3f9f25b1d-1268877433

just to note that since the above report, Skrommel has re-compiled all the Exe files of his programs and below is the link to Virustotal's analysis of the new Captain.exe.

http://www.virustota...dbfed0451-1274851845

beslam

  • Participant
  • Joined in 2010
  • *
  • Posts: 16
    • View Profile
    • Donate to Member
Re: A Trojan in "Captain.exe" ?!
« Reply #9 on: May 26, 2010, 02:39 AM »
I seen . It is conclusive  ;)
Harry

Carol Haynes

  • Waffles for England (patent pending)
  • Global Moderator
  • Joined in 2005
  • *****
  • Posts: 8,069
    • View Profile
    • Donate to Member
Re: A Trojan in "Captain.exe" ?!
« Reply #10 on: May 26, 2010, 07:29 AM »
1/ I doawnloaded captain.exe from https://www.donation...l/index.html#Captain

2/ The adress of the report of virustotal :
http://www.virustota...3f9f25b1d-1268877433

just to note that since the above report, Skrommel has re-compiled all the Exe files of his programs and below is the link to Virustotal's analysis of the new Captain.exe.

http://www.virustota...dbfed0451-1274851845

It is interesting to see from that report that two versions of MacAfee come to different conclusions ;)

Arse/Elbow springs to mind  :-[

beslam

  • Participant
  • Joined in 2010
  • *
  • Posts: 16
    • View Profile
    • Donate to Member
Re: A Trojan in "Captain.exe" ?!
« Reply #11 on: May 26, 2010, 12:20 PM »
Yes, I've noticed the same thing with Avast also ;)
Harry

daddydave

  • Supporting Member
  • Joined in 2008
  • **
  • Posts: 867
  • test
    • View Profile
    • Donate to Member
Re: A Trojan in "Captain.exe" ?!
« Reply #12 on: May 26, 2010, 12:27 PM »
At least we can all figure out what antivirus software to avoid.