forum.vdsworld.com

Mac · Last edited by Mac on Wed Jan 22, 2003 9:53 pm; edited 1 time in total

[EDIT] ** This issue has been resolved - it was a false reading
and Trend Micro has fixed the problem **

>>>> JOKE Pchaunt.a virus <<<<

I strongly urge everyone to go to Trend Micro's online virus
scanner site:

http://housecall.antivirus.com/housecall/start_corp.asp

and scan all drives on your computer - no matter what
anti-virus software you currently use. This virus is non-
cleanable and appears to be in all of my VDS EXEs.

Cheers, Mac Smile

Mac · Posted: Sat Jan 11, 2003 10:11 am Post subject:

Upon further investigation, I think this may be a possible
mis-diagnosis since I have had none of the virus symptoms.

I have also replaced VDS and the runtime DLL from a backup,
but everything I compile still shows to have the virus. I've sent
Trend Micro a sample file, and am awaiting a response.

I'd kinda like to know if anyone else is getting the same
diagnosis on VDS EXEs - it may just be a VDS 3x signature... Confused

Cheers, Mac Smile

Tsunami1988 · Posted: Sat Jan 11, 2003 10:15 am Post subject:

Skit3000 · Posted: Sat Jan 11, 2003 11:11 am Post subject:

A virusscanner just browses through EXE files to see if there is a peace of code of a virus. It does not search for the whole code, because some virusses can change. Maybe you can try to use the online McAfee virusscan, which is one of the best of all... If that one doesn't find any, Trend Micro may be wrong...

Tsunami1988 · Posted: Sat Jan 11, 2003 11:23 am Post subject:

Skit3000 · Posted: Sat Jan 11, 2003 11:37 am Post subject:

In that case I hope that McAfee and Trend Micro do not cooperate... Sad

arcray · Posted: Sat Jan 11, 2003 12:13 pm Post subject:

I believe you are getting false positives, even if the symptoms would only occur on Haloween. Try setting your machine up for the last day in October to see.

There were other false positives for VDS code around three years ago and SADE had to liase with the virus houses to take that false signature off the books.

In the meantime use an alternative virus scanner such as Sophos etc., McAfee and Trend have a vested interest in scaring you, so that you will buy their products and they therefore are not too unhappy with false positives.

Dr. Dread · Posted: Sat Jan 11, 2003 3:05 pm Post subject:

I use PC-cillin from Trend and it reports absolutely nothing using the latest virus def updates.
But I checked out the on-line scanner and it reports loads of infected VDS EXEs, all right. But I'm
pretty sure that those are false positives. I have Bitdefender and McAfee running on other boxes
here at work, and they state that everything checks out OK.

Greetz
Dr. Dread

FreezingFire · **Admin Team** Joined: 23 Jun 2002 Posts: 3508

__________________________________________________________________________________________________________________________
This has been discussed before in the Registered Users Area. Here's an
excerpt from the topic:

FreezingFire · **Admin Team** Joined: 23 Jun 2002 Posts: 3508

BTW, is there any info on JOKE Pchaunt.a virus? Not even a search
on Google.com turns anything up. Confused

Skit3000 · Posted: Sat Jan 11, 2003 5:29 pm Post subject:

I took a search at the McAfee virus library (http://vil.mcafee.com/alphar.asp), and even there I couldn't find any about it... Sad

Mac · Posted: Sat Jan 11, 2003 7:23 pm Post subject:

info on the virus:
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=JOKE_PCHAUNT.A&VSect=T

When I reset my clock to Halloween day and ran a small program
that shows to be infected, nothing happened. I even opened wordpad
for it...

Also - while this does not show up with Norton, the virus is not in their
online virus encyclopedia either...

Here's the reply from Micro Trend (hopefully they didn't just
scan this file...):
____________________________________________________________

Dear Mac,

The file you have submitted was determined be infected with JOKE_PCHAUNT.A

JOKE_PCHAUNT.A : This Windows-based joke program is designed for use during Halloween. It greets the user with his/her name and makes the user believe that the computer is haunted by a spirit by typing messages in Wordpad. It also opens and closes the CD-ROM drive and plays with the Solitaire, a computer game. This is a non-destructive program that does not make any system modification.

Joke programs are ordinary executable programs. They are added to the detection list because they are found to be very annoying or contain pornographic images. Joke programs cannot spread unless someone deliberately distributes them. To get rid of a Joke program, delete it from the system.

Solution:
Keep your pattern file and scan engine updated. Trend Micro antivirus software can clean or remove most types of viruses. Certain viruses, such as Trojans, scripts, overwriting viruses and joke programs which are identified as "uncleanable", should simply be deleted. When deleted, please make sure that you also delete these files from your Recycle Bin.

Please update your pattern file and scan engine regularly to keep you safe from virus attack.

Download the latest pattern at this site: http://www.trendmicro.com/download/pattern.asp
Download the latest scan engine at this site: http://www.trendmicro.com/download/engine.asp

Should you need further assistance, please feel free to email us again.

Sincerly,
Kay B. Baylon
Virus Watch Team, Antivirus Group
TrendLabs HQ, Trend Micro Incorporated
____________________________________________________________

I have emailed them again asking for details on how they checked
the file. If you want to contact them, the email is:
Virus_Doctor@trendmicro.com

Cheers, Mac Smile

MarkTrubo · Posted: Sat Jan 11, 2003 7:53 pm Post subject:

Odd that the anti-virus leaders Symantec and Mcafee wold not have info on this. By-the-way, the description of the virus was pretty funny -- of course I would have freaked if it happend to me though.

FreezingFire · **Admin Team** Joined: 23 Jun 2002 Posts: 3508

Dr. Dread · Posted: Sat Jan 11, 2003 11:00 pm Post subject:

I still don't understand why the Trend on-line scanner report these files as infected while Trend's
ordinary AV program (PCcillin) and several other scanners do not. Still sounds like a false
reading.

Greetz
Dread