Complaint Virus

[Zisly]

Well I just found a thread with a virus in the distributions forum.
It has been there from 24th December 2008.
Thread: http://otland.net/f18/8-3-8-31-eldinworld-sql-edit-me-18110/

My complaint is that noone has reacted on it.
It's clearly a virus.
The thread is full of noobs with very low post counts saying "nice"."there is no virus" etc.
Which probably are the same person.

And a mod has said that it's clean probably without even checking it out. no names mentioned.

Anyways, it has been reported but I felt like doing a thread for the ones which downloaded this and ran it.

How to remove
First off just run your anti-virus scanner.
The things which needs to be deleted are:

• A temp file in c:\ named temp****.temp
  ****=random number
• issas.exe at autostart
• A copy of itself in "c:\documents and settings\*USER_NAME*\local settings" (don't know the english dir)
• A file in the windows\prefetch folder.
  Named: ELDINWORLD.EXE-1F93B174.pf

If your anti-virus doesn't find them all, you will have to do it manually.

• Reboot in safe-mode.
• Run>msconfig
  Chose autostart and remove issas.exe
• Start file search and search for 'eldin'
  Remove the files mentioned.
• Go to c:\ and remove the temp file.

 

[Archez]

A moderator posted there:

This file is clean, it doesn't contain any virus.

Just remove the file, and warn the moderators to be checking carefuly...

 

[zoubiey]

Great, now i know what issas.exe are >.<
I have 3 issas.exe:
issas.0xe
issas.1xe
and have deleted issas.2xe

 

[Zisly]

A moderator posted there:



Just remove the file, and warn the moderators to be checking carefuly...

The problem is that he probably didn't even check.
If he would have checked it he would have noticed that the server doesn't start, nothing pops up.
It just runs for some seconds to extract the virus files

 

[Master-m]

Thanks for telling.

 

[Zonet]

Also peoples can put the distro, after a moderator scanns it, they change, also uploads a new:/

 

[hiperkarma]

zorro, your are harming us!

 

[Zisly]

Also peoples can put the distro, after a moderator scanns it, they change, also uploads a new:/

I thought you couldn't edit your posts in the download section.
Or do you mean that the mods would put a virus link?

 

[Fablow]

He prolly changed the link before the edit button got removed.

 

[ZoOorO]

Before you post something and say I'm not scanning check your information. I scanned it and virustotal didn't give me any viruses expect 32/delf shit. If your going to complain then do it to virustotal not me.

 

[Dante]

your right

 

[Zisly]

Before you post something and say I'm not scanning check your information. I scanned it and virustotal didn't give me any viruses expect 32/delf shit. If your going to complain then do it to virustotal not me.

Don't you find it suspicious when there isn't any false positives, which 99% of the server get?
I'm not blaming you, well maybe a little..

 

[Eldin]

Realy?

If what your telling me is true, I would like to say sorry.
I have never and would never post out a virus that I would know about.
Why lay down all this work to hack someone? Their are easier ways.

I deeply hope that this aint true, so how could this be?
I download the file from the official TFS thread,
now I update it into EldinWorld and release it again.

One thing I can think of is that I somehow got a virus from downloading another OT version
a long time ago and now it "jumps" into the .exe files itself once I download a new version.
The second would be that TFS got it from the begining wich I doupt.
The third would that its not actualy a virus.
Another reason could maybe be that your not realy a fan of me and trying to spread some bullshit.

However, I do get warnings aswell, but thats for Win32 in wich I get from any server.
I canno't prove anything more against you so right now, I can only hope that this aint true.
Just trying to give people a nice server.

Kind Regards,
Eldin.

 

[Zisly]

If what your telling me is true, I would like to say sorry.
I have never and would never post out a virus that I would know about.
Why lay down all this work to hack someone? Their are easier ways.

I deeply hope that this aint true, so how could this be?
I download the file from the official TFS thread,
now I update it into EldinWorld and release it again.

One thing I can think of is that I somehow got a virus from downloading another OT version
a long time ago and now it "jumps" into the .exe files itself once I download a new version.
The second would be that TFS got it from the begining wich I doupt.
The third would that its not actualy a virus.
Another reason could maybe be that your not realy a fan of me and trying to spread some bullshit.

However, I do get warnings aswell, but thats for Win32 in wich I get from any server.
I canno't prove anything more against you so right now, I can only hope that this aint true.
Just trying to give people a nice server.

Kind Regards,
Eldin.

Man, before start attacking me have facts.
It was a edit of your server released my some other guy, he simply replaced the .exe with his own.
So take it easy -.-

 

[Eldin]

Hah, my bad.
Good luck.

Kind Regards,
Eldin.

 

[krille09]

Before you post something and say I'm not scanning check your information. I scanned it and virustotal didn't give me any viruses expect 32/delf shit. If your going to complain then do it to virustotal not me.

well if you got that 32/delf shit your not supposed to tell it's clean, you find a virus, even if it was the one tfs got in their normal...

 

[JayBeee]

well if you got that 32/delf shit your not supposed to tell it's clean, you find a virus, even if it was the one tfs got in their normal...

The win32\delf stuff is not a virus.

 

[Master-m]

The win32\delf stuff is not a virus.

yes is

 

[ZoOorO]

yes is

No it ain't.

 

[Zisly]

The win32\delf stuff is not a virus.

No it ain't.

win32 only says it's for windows 32bit.
It can still be a virus, so stop lying to people.