GRAND MAL WARE IN BETA VERSION 5

[JOE BLOW]

Stan;

I started to download your beta version of Expert lotto 5, from this link, http://www.expertlotto.com/files/v5/exp ... indows.exe

And my Anti-Virus software AVIRA popped up and stopped the download because it discovered a SERIOUS GRAND MAL WARE VIRUS.

Looks like your site or server has been compromised. OR one of your helpers is having fun attaching a virus in beta dowloads.


WARNING FOR THOSE THAT DOWNLOADED THE BETA VERSION OF EXPERT LOTTO VERSION 5, HAVE YOUR COMPUTER SCAN BY AVIRA ANTI-VIRIUS SOFTWARE, THEY GIVE A FREE VERSION.

[daniel]

Stan;

I started to download your beta version of Expert lotto 5, from this link, http://www.expertlotto.com/files/v5/exp ... indows.exe

And my Anti-Virus software AVIRA popped up and stopped the download because it discovered a SERIOUS GRAND MAL WARE VIRUS.

Looks like your site or server has been compromised. OR one of your helpers is having fun attaching a virus in beta dowloads.


WARNING FOR THOSE THAT DOWNLOADED THE BETA VERSION OF EXPERT LOTTO VERSION 5, HAVE YOUR COMPUTER SCAN BY AVIRA ANTI-VIRIUS SOFTWARE, THEY GIVE A FREE VERSION.

Anti Virus programs will sometimes produce false positives. Had no warnings from Avast.
daniel

[JOE BLOW]

Stan;

I started to download your beta version of Expert lotto 5, from this link, http://www.expertlotto.com/files/v5/exp ... indows.exe

And my Anti-Virus software AVIRA popped up and stopped the download because it discovered a SERIOUS GRAND MAL WARE VIRUS.

Looks like your site or server has been compromised. OR one of your helpers is having fun attaching a virus in beta dowloads.


WARNING FOR THOSE THAT DOWNLOADED THE BETA VERSION OF EXPERT LOTTO VERSION 5, HAVE YOUR COMPUTER SCAN BY AVIRA ANTI-VIRIUS SOFTWARE, THEY GIVE A FREE VERSION.

Anti Virus programs will sometimes produce false positives. Had no warnings from Avast.
daniel

****************************************************************************************************************************************************************************

TRUE, WHY NOT DOWNLOAD THE FREE VERSION OF AVIRA UPDATE THE DEFINITIONS AND SCAN YOUR COMPUTER?

IT IS ALSO TRUE NOT ALL VIRUSES AND MAL WARE IS SPOTTED BY ANY ONE ANTI VIRUS PROGRAM.

I trust my Avira. But lets hear from Stan if he checks the codes and says he does not see anything, then I will investigate further.

However if the Avira NAMES THE MAL WARE OR VIRUS AND HAS IT IN ITS FILE, then I am 100% sure there is an infection tied to the program.

[PadawanLotto]

WHY NOT DOWNLOAD THE FREE VERSION OF AVIRA UPDATE THE DEFINITIONS AND SCAN YOUR COMPUTER?

Hey Joe, I downloaded the free version of Avira and it found no problems. I even re-downloaded the link that you said had a virus and Avira found nothing. Some anti-virus programs will target installers as malware. You say Avira named the malware, what was it?

[stan]

Looks like your site or server has been compromised. OR one of your helpers is having fun attaching a virus in beta dowloads.

i don't think so, looks like a false alarm to me.

[JOE BLOW]

Looks like your site or server has been compromised. OR one of your helpers is having fun attaching a virus in beta dowloads.

i don't think so, looks like a false alarm to me.

I will make an adjustment, as I generally put the heuristic on high, so its possible to generate a false flag. i will reset it and download. Let u know what happens.

[JOE BLOW]

Stan,

This is not a false flag, it is a Trojan. Give me your email and I will send the file to you.

The name of the Trojan is the "TR/Dropper.Gen Trojan"

It appears you are using a canned software to write your program on and this is where the Trojan came from--I don't know.

BUT IT IS NOT A FALSE FLAG, IT IS A TROJAN WITH A NAME.

If the program had said unknown Mal ware then it could be a false flag, but not in this case.

Type: File
Source: C:\Users\Toshiba\Desktop\expertlotto-windows.exe.part
Status: Infected
Quarantine object: 48fce2bf.qua
Restored: NO
Uploaded to Avira: NO
Operating System: Windows 2000/XP/VISTA Workstation
Search engine: 8.02.04.02
Virus definition file: 7.10.08.185
Detection: Is the TR/Dropper.Gen Trojan
Date/Time: 6/25/2010, 0:47

[PadawanLotto]

I generally put the heuristic on high, so its possible to generate a false flag. i will reset it and download. Let u know what happens.

I set the heuristic to high and ran a scan and it said that (Application Data\Sun\Java\Deployment) was malware, it also said that my Adobe updater was malware. I did some research and it seems that Avira is like the only antivirus that detects TR/Dropper.Gen Trojan which is considered low threat if and threat at all.

[stan]

it's a false alarm. i have up-to-date antivirus (avast) & firewall on my machine, apply all windows updates and i don't click 'funny links' my friends email me. also see padawanlotto's post above.

[MartinMan]

Not sure how this will format, but this is a list of 40 programs finding Nothing wrong with the program.
In addition I also used my Malwarebytes updated to this morning and it found Nothing.

Regards,
Martin



Antivirus Version Last Update Result
a-squared 5.0.0.31 2010.06.29 -
AntiVir 8.2.4.2 2010.06.29 -
Antiy-AVL 2.0.3.7 2010.06.25 -
Authentium 5.2.0.5 2010.06.29 -
Avast 4.8.1351.0 2010.06.29 -
Avast5 5.0.332.0 2010.06.29 -
AVG 9.0.0.836 2010.06.29 -
BitDefender 7.2 2010.06.29 -
CAT-QuickHeal 10.00 2010.06.29 -
ClamAV 0.96.0.3-git 2010.06.29 -
Comodo 5254 2010.06.29 -
DrWeb 5.0.2.03300 2010.06.29 -
eSafe 7.0.17.0 2010.06.28 -
eTrust-Vet 36.1.7674 2010.06.29 -
F-Prot 4.6.1.107 2010.06.29 -
F-Secure 9.0.15370.0 2010.06.29 -
Fortinet 4.1.133.0 2010.06.29 -
GData 21 2010.06.29 -
Ikarus T3.1.1.84.0 2010.06.29 -
Jiangmin 13.0.900 2010.06.27 -
Kaspersky 7.0.0.125 2010.06.29 -
McAfee 5.400.0.1158 2010.06.29 -
McAfee-GW-Edition 2010.1 2010.06.29 -
Microsoft 1.5902 2010.06.29 -
NOD32 5236 2010.06.29 -
Norman 6.05.10 2010.06.29 -
nProtect 2010-06-29.01 2010.06.29 -
Panda 10.0.2.7 2010.06.28 -
PCTools 7.0.3.5 2010.06.29 -
Prevx 3.0 2010.06.29 -
Rising 22.54.01.03 2010.06.29 -
Sophos 4.54.0 2010.06.29 -
Sunbelt 6521 2010.06.29 -
Symantec 20101.1.0.89 2010.06.29 -
TheHacker 6.5.2.0.304 2010.06.28 -
TrendMicro 9.120.0.1004 2010.06.29 -
TrendMicro-HouseCall 9.120.0.1004 2010.06.29 -
VBA32 3.12.12.5 2010.06.29 -
ViRobot 2010.6.29.3912 2010.06.29 -
VirusBuster 5.0.27.0 2010.06.28 -

[JOE BLOW]

Not sure how this will format, but this is a list of 40 programs finding Nothing wrong with the program.
In addition I also used my Malwarebytes updated to this morning and it found Nothing.

Regards,
Martin



Antivirus Version Last Update Result
a-squared 5.0.0.31 2010.06.29 -
AntiVir 8.2.4.2 2010.06.29 -
Antiy-AVL 2.0.3.7 2010.06.25 -
Authentium 5.2.0.5 2010.06.29 -
Avast 4.8.1351.0 2010.06.29 -
Avast5 5.0.332.0 2010.06.29 -
AVG 9.0.0.836 2010.06.29 -
BitDefender 7.2 2010.06.29 -
CAT-QuickHeal 10.00 2010.06.29 -
ClamAV 0.96.0.3-git 2010.06.29 -
Comodo 5254 2010.06.29 -
DrWeb 5.0.2.03300 2010.06.29 -
eSafe 7.0.17.0 2010.06.28 -
eTrust-Vet 36.1.7674 2010.06.29 -
F-Prot 4.6.1.107 2010.06.29 -
F-Secure 9.0.15370.0 2010.06.29 -
Fortinet 4.1.133.0 2010.06.29 -
GData 21 2010.06.29 -
Ikarus T3.1.1.84.0 2010.06.29 -
Jiangmin 13.0.900 2010.06.27 -
Kaspersky 7.0.0.125 2010.06.29 -
McAfee 5.400.0.1158 2010.06.29 -
McAfee-GW-Edition 2010.1 2010.06.29 -
Microsoft 1.5902 2010.06.29 -
NOD32 5236 2010.06.29 -
Norman 6.05.10 2010.06.29 -
nProtect 2010-06-29.01 2010.06.29 -
Panda 10.0.2.7 2010.06.28 -
PCTools 7.0.3.5 2010.06.29 -
Prevx 3.0 2010.06.29 -
Rising 22.54.01.03 2010.06.29 -
Sophos 4.54.0 2010.06.29 -
Sunbelt 6521 2010.06.29 -
Symantec 20101.1.0.89 2010.06.29 -
TheHacker 6.5.2.0.304 2010.06.28 -
TrendMicro 9.120.0.1004 2010.06.29 -
TrendMicro-HouseCall 9.120.0.1004 2010.06.29 -
VBA32 3.12.12.5 2010.06.29 -
ViRobot 2010.6.29.3912 2010.06.29 -
VirusBuster 5.0.27.0 2010.06.28 -

DO A RESEARCH ON the TR/Dropper.Gen Trojan.

IF STAN IS USING A TOSHIBA COMPUTER THEN THAT'S WHERE THE TR/Dropper.Gen Trojan IS COMING FROM.

[stan]

IF STAN IS USING A TOSHIBA COMPUTER THEN THAT'S WHERE THE TR/Dropper.Gen Trojan IS COMING FROM.

i don't have a toshiba computer. i have custom-built desktop and a lenovo notebook. i think you're wasting your time with this virus hunting. if you want i can upload a zip archive to our web server and then you can start expert lotto without using any .exe file (just the java runtime).
another option is running expert lotto on linux or mac - or switch to a different lottery software...

[Savage_Rottweiler]

I scanned it using Intego Virusbarrier on my Mac and it is clean.. also used ESET Nod32 in my Windows VM no Virus...