Page 1 of 1

Trojan detected in RVS Community Map Pack 3 & others.

Posted: 18 Mar 2004, 06:40
by Hudson
Several maps and map packs are coming up as being infected with a trojan called Unone with mcafee and the latest DAT files out last night; I suspect that it is a false positive as I can not find information about any such virus in the Virus Information Library on NAI's website:
http://vil.nai.com/vil/default.asp

or anywhere else on the net.

I downloaded clean, and rescanned on a linux pc to make sure it wasn't somehow infected after I had downloaded it; and it did come up infected as well, so I took one of the smaller ones and sent it off to NAI to be analyzed. If past experience is anything to go by I imagine I will hear back from them by the end of the day, as this is not the first false positive I've managed to discover...


[root@xxx mods]# /opt/mcafee/uvscan rvc_map_blackstar_1a.exe rvc_pack_v3.exe rvc_pack_wof2.exe rvc_pack_wof.exe
/opt/mcafee/infected/var/www/html/mods/rvc_map_blackstar_1a.exe
Found the Unone trojan !!!
/opt/mcafee/infected/var/www/html/mods/rvc_pack_v3.exe
Found the Unone trojan !!!
/opt/mcafee/infected/var/www/html/mods/rvc_pack_wof2.exe
Found the Unone trojan !!!
/opt/mcafee/infected/var/www/html/mods/rvc_pack_wof.exe
Found the Unone trojan !!!

Posted: 18 Mar 2004, 15:22
by Madrus
why dont u just dl the map packs from our server? the links are still up in the Ravenshield forum under RvS maps. No one has reported a virus so far in those files.

Those are coming up as infected as well

Posted: 18 Mar 2004, 16:58
by Hudson
They're all coming up infected whereever I download them from; like i said im sure its a false positive; but i sent it off to nai so i would hear better; my work email is not immediately available and im about to fall back to unconciousness before getting my work computer out so ill just have to wait till tomorrow