Page 1 of 1
Trojan Alert
Posted: Sun Jun 01, 2008 6:55 am
by Concerned Guest
Beware
The complete version of XnView in .zip form contains a trojan in the pngout.exe file. It also dropped a file in the C:\System Volume Information \... folder.
Goto:
http://www.trendmicro.com/vinfo/virusen ... V&VSect=Sn
to download a fix tool for this. Click on "Download the fixtool here", unzip the file and run it.
Posted: Sun Jun 01, 2008 7:23 am
by marsh
See following topic:
pngout.exe
Posted: Sun Jun 01, 2008 9:35 am
by helmut
Yes, a known false alert of TrendMicro virus scanner.
Posted: Sun Jun 01, 2008 11:12 am
by ckv
And the reason it goes in C:\System Volume Information\ is the Windows XP system restore. When changes are made to the system (e.g. install new software) XP automatically creates a restore point and it backsup some of the new stuff in there.
Pngout is getting lot of warnings from AVs cause it's packed with scrambled UPX (Which I think is pretty stupid.
).
http://www.virustotal.com/analisis/fe34 ... 712a067de5
false positive
Posted: Mon Jun 02, 2008 10:20 am
by (now un)Concerned Guest
Cheers for the info.
Posted: Mon Jun 02, 2008 6:16 pm
by helmut
False warnings and alerts are no good and irritatating - even if they are false. pngout is bundled into the XnView complete package, so we should care and contact the author of pngout.
@Pierre: Could you please contact him and ask whether he's aware of the virus scanner problem and whether can/will do something about this?
Posted: Tue Jun 03, 2008 7:41 am
by xnview
helmut wrote:
False warnings and alerts are no good and irritatating - even if they are false. pngout is bundled into the XnView complete package, so we should care and contact the author of pngout.
@Pierre: Could you please contact him and ask whether he's aware of the virus scanner problem and whether can/will do something about this?
The author of pngout don't reply anymore to emails...
Posted: Wed Jun 04, 2008 5:49 am
by helmut
xnview wrote:The author of pngout don't reply anymore to emails...
Is he/she German? If so, I could try to contact him/her.