Page 1 of 1

is Z Expansion XP a Virus?

Posted: 2008-10-13, 12:31
by sabix
Hi all,

Antivir reports that Z Expansion XP is a virus/trojan. Anyone else received the message?


Regards
Sabix

Re: is Z Expansion XP a Virus?

Posted: 2008-10-13, 15:36
by Arriga
sabix wrote:Hi all,

Antivir reports that Z Expansion XP is a virus/trojan. Anyone else received the message?


Regards
Sabix
Yes, same problem here; however it never reported any anomaly before last week.

Re: is Z Expansion XP a Virus?

Posted: 2008-10-13, 16:00
by sabix
maybe it wasn't in before OR it was not FOUND before...


/EDIT: insert screenshot...

Link to virus information: (sorry german...)
http://www.avira.com/de/threats/section ... k.gen.html

/EDIT 2: tested Version 1.6 - same virus found!
looks like we're all member of a bot network :evil: so we don't need hamachi any longer.. :shock: don't we(?).

Re: is Z Expansion XP a Virus?

Posted: 2008-10-13, 18:43
by DesanN
This is what the result that I got from an online virus scan scanning the latest Version 1.6.5.

No Virus found
AntiVir
TR/Crypt.XPACK.Gen found
ArcaVir
No Virus found
Avast
No Virus found
AVG Antivirus
No Virus found
BitDefender
No Virus found
ClamAV
No Virus found
CPsecure
No Virus found
Dr.Web
No Virus found
F-Prot Antivirus
W32/Zbot.I.gen!Eldorado found
F-Secure Anti-Virus
No Virus found
G DATA
No Virus found
Ikarus
No Virus found
Kaspersky Anti-Virus
No Virus found
NOD32
No Virus found
Norman Virus Control
No Virus found
Panda Antivirus
No Virus found
Sophos Antivirus
No Virus found
VirusBuster
No Virus found
VBA32
No Virus found


I believe this is a false alarm, since my favorite virus scanner avast doesn't find any virus and most scanners didn't find anything (see above) and I think the two findings contradict themselves a little bit, I didn't check any further though.

Re: is Z Expansion XP a Virus?

Posted: 2008-10-13, 19:37
by Arriga
Avast:

http://img236.imageshack.us/my.php?imag ... inedl2.jpg

"I've found a virus!
Don't worry [...].

Name of the file: D:\Z\zxp.exe
Name of the malware: Win32:Weed
Kind of malware: Virus\Worm
VPS Version: bla bla bla

Reccomended option: put into basket

[...]"

By the way I had another problem along with this one: after playing once Z XP I have to uninstall and reinstall in order to run it again. It might be correlated with first issue.

P.S.: greetings to everybody from Italy!

Re: is Z Expansion XP a Virus?

Posted: 2008-11-28, 12:17
by keen
Just to be sure, I have sent the file to Avira to check for a false alarm officially. There is no malware whatsoever in the current version (1.65).
Datei ID Dateiname Größe (Byte) Ergebnis
25199184 setup_zexp.exe 1.32 MB FALSE POSITIVE

Die Datei 'setup_zexp.exe' wurde als 'FALSE POSITIVE' eingestuft. Dies bedeutet, dass diese Datei nicht gefährlich und eine Fehlmeldung unsererseits ist. Das Erkennungsmuster wird mit einem der nächsten Updates der Virendefinitionsdatei (VDF) entfernt werden.
It basically says "The file is not dangerous, Antivir has given a false alarm, with one of the next update of the virus definition file the issue will be resolved."

The program works fine with me (WindowsXP), although I must still run it in Windows 98 compatibility mode.

Re: is Z Expansion XP a Virus?

Posted: 2008-11-28, 20:23
by DesanN
keen wrote:Just to be sure, I have sent the file to Avira to check for a false alarm officially. There is no malware whatsoever in the current version (1.65).
Datei ID Dateiname Größe (Byte) Ergebnis
25199184 setup_zexp.exe 1.32 MB FALSE POSITIVE

Die Datei 'setup_zexp.exe' wurde als 'FALSE POSITIVE' eingestuft. Dies bedeutet, dass diese Datei nicht gefährlich und eine Fehlmeldung unsererseits ist. Das Erkennungsmuster wird mit einem der nächsten Updates der Virendefinitionsdatei (VDF) entfernt werden.
It basically says "The file is not dangerous, Antivir has given a false alarm, with one of the next update of the virus definition file the issue will be resolved."

The program works fine with me (WindowsXP), although I must still run it in Windows 98 compatibility mode.
How do they now it's a false alarm? I suppose they didn't check it manually or something...

Re: is Z Expansion XP a Virus?

Posted: 2008-11-29, 17:12
by keen
How do they now it's a false alarm? I suppose they didn't check it manually or something...
I don't no what they do exactly, but like most scanners Avira AntiVir works with search routines to determine not only known but also slightly changed versions of a virus. Some programs which are not dangerous are possibly categorized as dangerous. I guess on request they run additional checks which are not included in standard AntiVir, be it manually or via software. It took them a day anyway.

After all, there's no 100% guarantee for a safe download, and for sure not from a Russian webpage I cannot read. As for me, I trust in Avira Antivir and currently enjoy the jungle levels of Z on my WinXP laptop. But try on your own risk. :)

Re: is Z Expansion XP a Virus?

Posted: 2008-11-29, 19:51
by BallWin
keen wrote:After all, there's no 100% guarantee for a safe download, and for sure not from a Russian webpage I cannot read. As for me, I trust in Avira Antivir and currently enjoy the jungle levels of Z on my WinXP laptop. But try on your own risk. :)
Thanks for the done work.
I never doubted absence of a harmful code in a patch.
One remark: any other versions in the nature does not exist. Other sites have copied 1.6.5 of the Russian source. It is an official site of the developer which is not the computer hooligan.

Re: is Z Expansion XP a Virus?

Posted: 2008-11-30, 03:04
by keen
It is an official site of the developer which is not the computer hooligan.
No offense, I just wanted to share what a third party has to say about this issue. All fine. Thanks to the developer of this great little helper! ??? ????????.

Re: is Z Expansion XP a Virus?

Posted: 2009-01-01, 00:25
by zfrank
Hi,

To clean its reputation I have now submitted zexp 1.65 to the following anti virus companies for checking for 'false positive':

Code: Select all

Company                                Result
--------------------------------------------------------------------------------
F-Prot Antivirus (Frisk)              False Positive confirmed, no virus/malware
Avast                                 False Positive confirmed, no virus/malware
Bitdefender                           pending
A-squared                             pending

Avira (AntiVir)                       already has false positive confirmed, no virus/malware report anymore
My goal is to clean the list of false reports on jotti (http://virusscan.jotti.org/). It should get smaller by each day... ;)

Cheers

Frank