F1RS Edit is a virus!!!!

I use Norton AV 5.0 to scan my drives every week. I got the latest definitions today and did another scan. The virus name is PM Trojan (TIM). The filename is f1rsedit163.exe. The older 1.50 version was also a Trojan. Here is the logfile entry: The file F1rsedit163.exe in the compressed file C:\SCRATCH\F1RS\f1rsedit.zip is infected with the PM Trojan (TIM) virus. No action was taken. Here is the information about the virus which is provided by Norton AV: "This trojan attempts to steal PWL and ICQ passwords from the users system. An animated program is executed to appear as if nothing harmful is happening". Strangely after the program is installed the exe is not infected. Anyone know what is up with this???? -- Header address intentionally scrambled to ward off the spamming hordes. cisko [AT] ix [DOT] netcom [DOT] com

Quoted text (27 lines)

> I use Norton AV 5.0 to scan my drives every week. I got the > latest definitions today and did another scan. > The virus name is PM Trojan (TIM). The filename is f1rsedit163.exe. > The older 1.50 version was also a Trojan. > Here is the logfile entry: > The file F1rsedit163.exe in the compressed file > C:\SCRATCH\F1RS\f1rsedit.zip > is infected with the PM Trojan (TIM) virus. > No action was taken. > Here is the information about the virus which is provided by > Norton AV: > "This trojan attempts to steal PWL and ICQ passwords from > the users system. An animated program is executed to appear > as if nothing harmful is happening". > Strangely after the program is installed the exe is not infected. > Anyone know what is up with this???? > -- > Header address intentionally scrambled to ward off the spamming hordes. > cisko [AT] ix [DOT] netcom [DOT] com

On important piece of info: where did you get this file? If it comes from an honest gamer, maybe you should write to him about the discovery you made. If that's not the case, give us an e-mail address and we will send hate mail to this evil person! ;) Philster

Quoted text (17 lines)

>> "This trojan attempts to steal PWL and ICQ passwords from >> the users system. An animated program is executed to appear >> as if nothing harmful is happening". >> Strangely after the program is installed the exe is not infected. >> Anyone know what is up with this???? >> -- >> Header address intentionally scrambled to ward off the spamming hordes. >> cisko [AT] ix [DOT] netcom [DOT] com >On important piece of info: where did you get this file? If it comes >from an honest gamer, maybe you should write to him about the discovery >you made. If that's not the case, give us an e-mail address and we will >send hate mail to this evil person! ;)

Anyone can get it from www.f1racingsim.com , I just redownloaded it and confirmed the virus again. It is one of the better editors for F1RS. I suppose someone good enough to program an editor like that is good enough to program a virus. Interesting how it seemingly was OK until the latest virus definitions came out. As it turns out the file in question is the setup/install file for F1RS Edit 1.63. The actual installed f1rsedit.exe is not infected. So if I believe the info that Norton 5.0 provided, the trojan virus scans you HD for PWL and IQC password files as it is doing the install of F1RSedit... Presumably if this really is a virus the person who programmed it is good enough to hide the virus for quite a long time. Here is the author... My old copy of version 1.5 also claimed to have the virus. F1RS Editor V1.5 ---------------- Author: Arturo Baz Webpage: http://www.ozemail.com.au/~bazar/ Date: Mar 98 -- Header address intentionally scrambled to ward off the spamming hordes. cisko [AT] ix [DOT] netcom [DOT] com

Quoted text (26 lines)

> Anyone can get it from www.f1racingsim.com , I just redownloaded it and > confirmed the virus again. It is one of the better editors for F1RS. I > suppose > someone good enough to program an editor like that is good enough to > program a virus. Interesting how it seemingly was OK until the latest virus > definitions came out. > As it turns out the file in question is the setup/install file for F1RS Edit > 1.63. > The actual installed f1rsedit.exe is not infected. So if I believe the info > that > Norton 5.0 provided, the trojan virus scans you HD for PWL and IQC > password files as it is doing the install of F1RSedit... Presumably if this > really is a virus the person who programmed it is good enough to hide > the virus for quite a long time. > Here is the author... My old copy of version 1.5 also claimed to have the > virus. > F1RS Editor V1.5 > ---------------- > Author: Arturo Baz > Webpage: http://www.ozemail.com.au/~bazar/ > Date: Mar 98

Presumably this guy's machine has itself been infected with the trojan horse virus, and that's why it's in the installer - you should be warning him about it! Not to mention www.f1racingsim.com!

>Presumably this guy's machine has itself been infected with the trojan >horse virus, and that's why it's in the installer - you should be >warning him about it! >Not to mention www.f1racingsim.com! er... a Trojan Horse is not a virus. It is a malicious program pretending to be a nice friendly .exe and in any case, most of the anti-virii clods are *hopeless* /me gives much love to McAfee, who thoughfully began declaring any installer created with WISE ver 3 a trojan horse, thereby causing 100's of calls on back catalouge titles... Z. Please remove NOSPAM from my email address when replying.

Quoted text (8 lines)

> >Presumably this guy's machine has itself been infected with the trojan > >horse virus, and that's why it's in the installer - you should be > >warning him about it! > >Not to mention www.f1racingsim.com! > er... a Trojan Horse is not a virus. It is a malicious program pretending to > be a nice friendly .exe

Sure, the distinction is whether the malicious program spreads by inserting itself into other .exe files. But if this isn't a virus, how did it get into the installer - no-one would be stupid enough to deliberately put it into their installer (would they?). I was assuming that the trojan horse had been inserted into the installer by a virus, even if the trojan horse itself couldn't spread on its own. Sounds like a load of gibberish - ignore me, I'm just rambling now... ;-) I believe there's a web site somewhere devoted to exposing the devious dealings of anti-virus companies - I seem to remember McAfee's name cropping up a *lot* more often than anyone else's. Sadly I can't remember where the site was.

Quoted text (24 lines)

>Path: >> >Presumably this guy's machine has itself been infected with the trojan >> >horse virus, and that's why it's in the installer - you should be >> >warning him about it! >> >Not to mention www.f1racingsim.com! >> er... a Trojan Horse is not a virus. It is a malicious program pretending to >> be a nice friendly .exe >Sure, the distinction is whether the malicious program spreads by >inserting itself into other .exe files. >But if this isn't a virus, how did it get into the installer - no-one >would be stupid enough to deliberately put it into their installer >(would they?).

You misunderstand. the Virus scanner has found a strign which matches a known "Trojan Horse" string. not a virii string. It thinks this a dummy trogan horse, not a virus. The virus scanner is dumb. If a trojan horse really is found in a perfectly working installer., then it's the virus scanner at fault* Again, you're talking about a virus not a trojan horse. Well, in my case, they'd just added trojan horse support to the McAfee Virus-scan. and it was setting off on some versions Wise, which is about the 2nd most popular installer after Installshield. Calls to Mcafee finally got someone to admit "we suck" and gave advice to delete trojans.dat as it was detecting many many false alarms. Z. Please remove NOSPAM from my email address when replying.

Quoted text (8 lines)

>> Author: Arturo Baz >> Webpage: http://www.ozemail.com.au/~bazar/ >> Date: Mar 98 >Presumably this guy's machine has itself been infected with the trojan >horse virus, and that's why it's in the installer - you should be >warning him about it!

I did send him an email and so far no response. I did contact Rick and after an initial period of confusion he is now on the case. Interestingly he used McAfee AV and there was no virus found. Maybe Norton is just better :-) Anyway he is looking into it. Imagine all of those ICQ and PWL files that have been compromised. Rick said the number of times that file has been downloaded numbers in the thousands. I quarantined the virus and sent it to Norton for analysis. At first my request for analysis was denied because the file is a known virus and that is that! However I sent it anyway and got the following response: Dear Greg Cisko We have analyzed your submission. The following is a report of our findings for each file you have submitted: filename: C:\Scratch\F1rs\virus\F1rsedit163.exe machine: CISKO result: This file is infected with PM Trojan (TIM) The attached file is a self extracting zip containing updated virus definitions for Norton AntiVirus to successfully detect and repair this virus. Developer notes: C:\Scratch\F1rs\virus\F1rsedit163.exe is infected by a non-repairable virus or a Trojan Horse. You should delete this file and replace it if neccessary. Should you have any questions about your submission, please contact technical support at the appropriate number listed below and give them the tracking number in the subject of this message. ----------------------------------------------------------------------- This message was generated by SARC automation. Symantec worldwide technical support numbers -------------------------------------------- USA (+1) 541 465 8420 UK (+44) 0171 616 5813 FRANCE (+33) 1 64 53 80 63 GERMANY (+49) 069 6641 0353 HOLLAND (+31) 071 408 3952 SOUTH AFRICA (+27) 11784 9856 SWEDEN (+46) 8 735 5024 ITALY (+39) 0 542 28062 SWITZERLAND (+41) 12 12 1847 BELGIUM (+32) 27 131 701 NORWAY (+47) 23 05 33 30 DENMARK (+45) 35 44 57 20 SPAIN (+34) 9 1662 5255 AUSTRIA (+43) 150 137 5023 AUSTRALIA (+61) 2 9850 1050 HONG KONG (+852) 2528 6206 KOREA (+82) 2 3420 8650 MALAYSIA (+60) 3 704 9273 NEW ZEALAND 0800 442 795 SINGAPORE (+65) 239 2099 TAIWAN (+886) 2 2739 6068 I then called Norton and talked with customer support. The file is infected and that is that!!! I do have a hard time really believing it, but hey anything is possible. -- Header address intentionally scrambled to ward off the spamming hordes. cisko [AT] ix [DOT] netcom [DOT] com

>You misunderstand. the Virus scanner has found a strign which matches a known >"Trojan Horse" string. not a virii string. It thinks this a dummy trogan >horse, not a virus. The virus scanner is dumb. If a trojan horse really is So? What is your point? fault* The virus scanner is at fault??? Are you making this up as you are going? Holy shit pal. Perhaps we would all be better off if NAV did not look for malicious programs? I don't really give one shit whether it is officially called a virus or trojan horse or Worm.ExploreZip. If it is mailcious I want to know about it. Duh. However... Assuming this is no big deal, exactly what proof do you have that the installer for F1RS Edit version 1.63 does not have this malicious program? Speculating like you are doing is no proof. Maybe they do suck? I have no such problems with Norton AV. The only exception is the one incident with F1RS Edit 1.63. -- Header address intentionally scrambled to ward off the spamming hordes. cisko [AT] ix [DOT] netcom [DOT] com

Quoted text (15 lines)

>>You misunderstand. the Virus scanner has found a strign which matches a >known >>"Trojan Horse" string. not a virii string. It thinks this a dummy trogan >>horse, not a virus. The virus scanner is dumb. If a trojan horse really is >So? What is your point? >>found in a perfectly working installer., then it's the virus scanner at >fault* >The virus scanner is at fault??? Are you making this up as you >are going? Holy shit pal. Perhaps we would all be better off if >NAV did not look for malicious programs? I don't really give >one shit whether it is officially called a virus or trojan horse or >Worm.ExploreZip. If it is mailcious I want to know about it.

Quite simply, it is apparent you don't know the difference between a Trojan horse and a malicious virus. :) if norton is claiming it is a trojan horse, than it is mistaken. Who's speculating? It's apparent you don't understand quite what Norton is telling you. A "Trojan horse" is a seemingly normal program, that would wipe your head drive, or delete some data when executed, becuase you *thought* it was another file or somethign of use. This is not a "virus". A virus (normally) one loaded into memory, replicates itself, either in empty space of files (like win.cih) or in the boot sectors of floppy's, HD's, etc, so it spreads, and does malicious damage to files, system, etc. So it's apparent you do. All these AV programs do is look for known "problem strings" in code, and report on matches. They're not absolute. Z. Please remove NOSPAM from my email address when replying.

ixnews12.ix.netcom.com>: A Trojan Horse is a program that passes itself off as another with the intention of causing harm to either your system or it's integrity. Examples are the now generally defunct "Format" Trojan that wiped your HD and things like Back Orifice and NetBus. These are just files disguised to look as other files in order to get you to run them. A virus is a self replicating program that can do similar things to trojans but generally hides itself in another file rather than taking the whole thing over. Win.CIH and Melissa are these. Thus if a program that WORKS as this installer is supposeded to do (no I haven't downloaded it because I don't have F1RS installed any more) then it *cannot* be a virus. Is this hard for you to understand? If it *was* a trojan it would fail to work as intended (witness the "screensaver installer" that was actually BO that was doing the rounds) and either do damage immediately or hide itself somewhere waiting for whatever trigger it needs. Proof? Well as the AV program calls it a trojan yet it works the evidence is that it is not a trojan. A virus perhaps but not a trojan. However if, as some people mentioned, the installed files and any programs run after the installer don't make the AV program b0rk then the chances are the program has made a mistake. It's not impossible that a proper program would contain enough similarities to a known virus or trojan that a heuristic check wouldn't query them as potential hazards. I know this is the case because the documentation for my AV software at the office says this is the case. What Zonkie did not say was that it wasn't infected at all, what he said was that it was almost certainly NOT a trojan horse. As for McAfee, they did admit their technology was to fault but providing you were sure a program wasn't a trojan then you could tell the software to ignore it and run it anyway. The reason I deleted trojans.dat (as did Zonkie i would imagine) is that the number of times this installer was run or tested a day made it a serious annoyance to members of staff. I would advise calling your software supplier if you have doubts about the trojan alert as they tend not to publicise obvious flaws on their websites. *phew* If you can see a hole in my argument please feel free to point it out :) M

>Quite simply, it is apparent you don't know the difference between a Trojan >horse and a malicious virus. :) if norton is claiming it is a trojan horse, >than it is mistaken. A trojan can be *ANY* program good or bad that does something the user is unaware of. In this case stealing IQC password and Windows PWL files. Do you know for a fact that F1RS Edit 1.63 does not do this? A trojan can be any program which does something unexpected by the user. It could be good or bad. Perhaps you fellas should read the TROJAN chapter in "Maximum Security: A Hackers Guide to Protecting Your Internet Site and Network". I have and there is no proof that F1RS Edit 1.63 does not steal ICQ and WIndows password files. You have some other info wioth regards to that? I would like to hear it. I know what the hell a virus is. And perhaps I should have rephrased the subject to reflect that F1RS Edit is a trojan not a virus. In fact I will. My Apologies, I sent the file to Norton for analysis and even talked on the phone with one of their engineers. They insist the file contains the trojan which steals ICQ and Win passwords. You have some other helpful information on this??? -- Header address intentionally scrambled to ward off the spamming hordes. cisko [AT] ix [DOT] netcom [DOT] com

>Thus if a program that WORKS as this installer is supposeded to do (no I >haven't downloaded it because I don't have F1RS installed any more) then it >*cannot* be a virus. Is this hard for you to understand? If it *was* a I explained in my other post that I should have used Trojan in the subject and not virus. My apologies. What the hell do you mean by this? Just because it works, it is not a Trojan??? Perhaps you need to read the Trojan chapter in "Maximum Security: A Hackers Guide to Protecting Your Internet Site and Network" too. The install program can still function normaly and in the mean time steal the password files without the user knowing it. This the exact definition of what a trojan does. It is anything the user is unaware of, good or bad. In this case bad. Wrong. The trojan is in the installer program, not the resulting F1RSEdit EXE after the install. Sure no problem. -- Header address intentionally scrambled to ward off the spamming hordes. cisko [AT] ix [DOT] netcom [DOT] com

I've been using F1RS version 1.62 for over a year on my machine with no problems. I don't know much about trojans or virus', but I'm pretty sure that if this file is a problem Arturo will fix it. His older version edit program works fine, and the new version is posted on a reputable website. Enjoy F1RS!

>I've been using F1RS version 1.62 for over a year on my machine with no >problems. I don't know much about trojans or virus', but I'm pretty sure >that if this file is a problem Arturo will fix it. His older version edit >program works fine, and the new version is posted on a reputable website. >Enjoy F1RS! It isn't the F1RS Edit executable itself, it is the installer exe. I called Norton a second time and was told that they put the F1rsedit163.exe which I sent them, on an isolated machine and tested it to see if it steals passwords or not. They insist that it did. So if everyone wants to ignore this (including Rick D who runs the unofficial F1RS site) that is just fine with me. -- Header address intentionally scrambled to ward off the spamming hordes. cisko [AT] ix [DOT] netcom [DOT] com >> I use Norton AV 5.0 to scan my drives every week. I got the >> latest definitions today and did another scan. >> The virus name is PM Trojan (TIM). The filename is f1rsedit163.exe. >> The older 1.50 version was also a Trojan. >> Here is the logfile entry: >> The file F1rsedit163.exe in the compressed file >> C:\SCRATCH\F1RS\f1rsedit.zip >> is infected with the PM Trojan (TIM) virus. >> No action was taken. >> Here is the information about the virus which is provided by >> Norton AV: >> "This trojan attempts to steal PWL and ICQ passwords from >> the users system. An animated program is executed to appear >> as if nothing harmful is happening". >> Strangely after the program is installed the exe is not infected. >> Anyone know what is up with this???? >> -- >> Header address intentionally scrambled to ward off the spamming hordes. >> cisko [AT] ix [DOT] netcom [DOT] com

Thanks for posting Greg, I also ran Norton AV on the installer 1.63 exe and got the same result. Brian > >I've been using F1RS version 1.62 for over a year on my machine with no > >problems. I don't know much about trojans or virus', but I'm pretty sure > >that if this file is a problem Arturo will fix it. His older version edit > >program works fine, and the new version is posted on a reputable website. > >Enjoy F1RS! > It isn't the F1RS Edit executable itself, it is the installer exe. I called > Norton a second time and was told that they put the F1rsedit163.exe > which I sent them, on an isolated machine and tested it to see if > it steals passwords or not. They insist that it did. So if everyone > wants to ignore this (including Rick D who runs the unofficial F1RS > site) that is just fine with me.

>Thanks for posting Greg, >I also ran Norton AV on the installer 1.63 exe and got the same result. >Brian Well once you get the latest definitions dated 7/2/1999 you will find the file is no longer "infected". Obviously I have been had by Norton AV. I even called their tech support twice and they insisted that they checked the file and it had that trojan. Obviously they did not. I plan to call them again and send the file again and see why they gave erronious information. So as of now F1RS edit seems cool. Arturo never did contact me (I did email him) to ask what the deal was. But as of now I would like to apololgize to him. At least until the next virus definitions come out :-) I did learn alot avout this AV stuff. Namely you really do not know. Even sending the file to Norton for analysis is a half baked sham. -- Header address intentionally scrambled to ward off the spamming hordes. cisko [AT] ix [DOT] netcom [DOT] com >> >I've been using F1RS version 1.62 for over a year on my machine with no >> >problems. I don't know much about trojans or virus', but I'm pretty sure >> >that if this file is a problem Arturo will fix it. His older version >edit >> >program works fine, and the new version is posted on a reputable website. >> >Enjoy F1RS! >> It isn't the F1RS Edit executable itself, it is the installer exe. I >called >> Norton a second time and was told that they put the F1rsedit163.exe >> which I sent them, on an isolated machine and tested it to see if >> it steals passwords or not. They insist that it did. So if everyone >> wants to ignore this (including Rick D who runs the unofficial F1RS >> site) that is just fine with me.

This is an email I sent to norton today in reply to an email I received from Norton: Well according to the definitions dated 6/28/99 there was a virus and your labs confirmed the trojan existed. This is the *SAME* file I submitted on 6/29/99 which is tracking number 33678. I have included your reply at the end of this message. If you scan this file with the 6/28/99 definitions it will show the trojan. The 7/2/99 definitions does not show the trojan because the PM Trojan (TIM) virus is not in the definitions. Instead there are definitions for PM Trojan (TIM) (2) and PM Trojan (TIM) (3). Please clarify what the discrepancy is. Thanks, Greg -------------- Received: from gavin.symantec.com (host44-sub156.symantec.com [155.64.156.44]) by ixmail8.ix.netcom.com (8.8.7-s-4/8.8.7/(NETCOM v1.01)) with ESMTP id FAA06461; by gavin.symantec.com (8.8.7/8.8.7) id FAA31077; Tue, 29 Jun 1999 05:59:26 -0700 Date: Tue, 29 Jun 1999 05:59:26 -0700 Content-Type: multipart/mixed; boundary="----------=_930661166-161-741" Mime-Version: 1.0 X-Mailer: MIME-tools 4.103 (Entity 4.115) Subject: SARC Automation: Tracking #33678 Status: RO This is a multi-part message in MIME format... ------------=_930661166-161-741 Content-Type: text/plain Content-Disposition: inline Below is a status update on your virus submission: Dear Greg Cisko We have analyzed your submission. The following is a report of our findings for each file you have submitted: filename: C:\Scratch\F1rs\virus\F1rsedit163.exe machine: CISKO result: This file is infected with PM Trojan (TIM) The attached file is a self extracting zip containing updated virus definitions for Norton AntiVirus to successfully detect and repair this virus. Developer notes: C:\Scratch\F1rs\virus\F1rsedit163.exe is infected by a non-repairable virus or a Trojan Horse. You should delete this file and replace it if neccessary. Should you have any questions about your submission, please contact technical support at the appropriate number listed below and give them the tracking number in the subject of this message. ----------------------------------------------------------------------- This message was generated by SARC automation. Symantec worldwide technical support numbers -------------------------------------------- USA (+1) 541 465 8420 UK (+44) 0171 616 5813 FRANCE (+33) 1 64 53 80 63 GERMANY (+49) 069 6641 0353 HOLLAND (+31) 071 408 3952 SOUTH AFRICA (+27) 11784 9856 SWEDEN (+46) 8 735 5024 ITALY (+39) 0 542 28062 SWITZERLAND (+41) 12 12 1847 BELGIUM (+32) 27 131 701 NORWAY (+47) 23 05 33 30 DENMARK (+45) 35 44 57 20 SPAIN (+34) 9 1662 5255 AUSTRIA (+43) 150 137 5023 AUSTRALIA (+61) 2 9850 1050 HONG KONG (+852) 2528 6206 KOREA (+82) 2 3420 8650 MALAYSIA (+60) 3 704 9273 NEW ZEALAND 0800 442 795 SINGAPORE (+65) 239 2099 TAIWAN (+886) 2 2739 6068 -- Header address intentionally scrambled to ward off the spamming hordes. cisko [AT] ix [DOT] netcom [DOT] com

>> Should you have questions or need assistance with NAV, please don't >> hesitate to contact our Technical Support at (541) 465-8420. >> Thank you for your patients, >> Symantec Antivirus Research Center 'patients'? This from a company that should KNOW better? Doesn't give me much confidence... __ Put your message in a modem, and throw it in the ***-sea... remove SPAM-OFF to reply.