is Z Expansion XP a Virus?

[sabix]

Hi all,

Antivir reports that Z Expansion XP is a virus/trojan. Anyone else received the message?


Regards
Sabix

[Arriga]

Hi all,

Antivir reports that Z Expansion XP is a virus/trojan. Anyone else received the message?


Regards
Sabix

Yes, same problem here; however it never reported any anomaly before last week.

[sabix]

maybe it wasn't in before OR it was not FOUND before...


/EDIT: insert screenshot...

Link to virus information: (sorry german...)
http://www.avira.com/de/threats/section ... k.gen.html

/EDIT 2: tested Version 1.6 - same virus found!
looks like we're all member of a bot network so we don't need hamachi any longer.. don't we(?).

[DesanN]

This is what the result that I got from an online virus scan scanning the latest Version 1.6.5.

No Virus found
AntiVir
TR/Crypt.XPACK.Gen found
ArcaVir
No Virus found
Avast
No Virus found
AVG Antivirus
No Virus found
BitDefender
No Virus found
ClamAV
No Virus found
CPsecure
No Virus found
Dr.Web
No Virus found
F-Prot Antivirus
W32/Zbot.I.gen!Eldorado found
F-Secure Anti-Virus
No Virus found
G DATA
No Virus found
Ikarus
No Virus found
Kaspersky Anti-Virus
No Virus found
NOD32
No Virus found
Norman Virus Control
No Virus found
Panda Antivirus
No Virus found
Sophos Antivirus
No Virus found
VirusBuster
No Virus found
VBA32
No Virus found


I believe this is a false alarm, since my favorite virus scanner avast doesn't find any virus and most scanners didn't find anything (see above) and I think the two findings contradict themselves a little bit, I didn't check any further though.

[Arriga]

Avast:

http://img236.imageshack.us/my.php?imag ... inedl2.jpg

"I've found a virus!
Don't worry [...].

Name of the file: D:\Z\zxp.exe
Name of the malware: Win32:Weed
Kind of malware: Virus\Worm
VPS Version: bla bla bla

Reccomended option: put into basket

[...]"

By the way I had another problem along with this one: after playing once Z XP I have to uninstall and reinstall in order to run it again. It might be correlated with first issue.

P.S.: greetings to everybody from Italy!

[keen]

Just to be sure, I have sent the file to Avira to check for a false alarm officially. There is no malware whatsoever in the current version (1.65).

Datei ID Dateiname Größe (Byte) Ergebnis
25199184 setup_zexp.exe 1.32 MB FALSE POSITIVE

Die Datei 'setup_zexp.exe' wurde als 'FALSE POSITIVE' eingestuft. Dies bedeutet, dass diese Datei nicht gefährlich und eine Fehlmeldung unsererseits ist. Das Erkennungsmuster wird mit einem der nächsten Updates der Virendefinitionsdatei (VDF) entfernt werden.

It basically says "The file is not dangerous, Antivir has given a false alarm, with one of the next update of the virus definition file the issue will be resolved."

The program works fine with me (WindowsXP), although I must still run it in Windows 98 compatibility mode.

[DesanN]

Just to be sure, I have sent the file to Avira to check for a false alarm officially. There is no malware whatsoever in the current version (1.65).

Datei ID Dateiname Größe (Byte) Ergebnis
25199184 setup_zexp.exe 1.32 MB FALSE POSITIVE

Die Datei 'setup_zexp.exe' wurde als 'FALSE POSITIVE' eingestuft. Dies bedeutet, dass diese Datei nicht gefährlich und eine Fehlmeldung unsererseits ist. Das Erkennungsmuster wird mit einem der nächsten Updates der Virendefinitionsdatei (VDF) entfernt werden.

It basically says "The file is not dangerous, Antivir has given a false alarm, with one of the next update of the virus definition file the issue will be resolved."

The program works fine with me (WindowsXP), although I must still run it in Windows 98 compatibility mode.

How do they now it's a false alarm? I suppose they didn't check it manually or something...

[keen]

How do they now it's a false alarm? I suppose they didn't check it manually or something...

I don't no what they do exactly, but like most scanners Avira AntiVir works with search routines to determine not only known but also slightly changed versions of a virus. Some programs which are not dangerous are possibly categorized as dangerous. I guess on request they run additional checks which are not included in standard AntiVir, be it manually or via software. It took them a day anyway.

After all, there's no 100% guarantee for a safe download, and for sure not from a Russian webpage I cannot read. As for me, I trust in Avira Antivir and currently enjoy the jungle levels of Z on my WinXP laptop. But try on your own risk.

[BallWin]

After all, there's no 100% guarantee for a safe download, and for sure not from a Russian webpage I cannot read. As for me, I trust in Avira Antivir and currently enjoy the jungle levels of Z on my WinXP laptop. But try on your own risk.

Thanks for the done work.
I never doubted absence of a harmful code in a patch.
One remark: any other versions in the nature does not exist. Other sites have copied 1.6.5 of the Russian source. It is an official site of the developer which is not the computer hooligan.

[keen]

It is an official site of the developer which is not the computer hooligan.

No offense, I just wanted to share what a third party has to say about this issue. All fine. Thanks to the developer of this great little helper! ??? ????????.

[zfrank]

Hi,

To clean its reputation I have now submitted zexp 1.65 to the following anti virus companies for checking for 'false positive':

Code: Select all

Company                                Result
--------------------------------------------------------------------------------
F-Prot Antivirus (Frisk)              False Positive confirmed, no virus/malware
Avast                                 False Positive confirmed, no virus/malware
Bitdefender                           pending
A-squared                             pending

Avira (AntiVir)                       already has false positive confirmed, no virus/malware report anymore

My goal is to clean the list of false reports on jotti (http://virusscan.jotti.org/). It should get smaller by each day...

Cheers

Frank