SRL Archive - News and General

Hi guys,

Backdoor.Win32.Dilf.ibx, found while installing SRL Rev #17 using Subversion 1.4.5

I posted this information yesterday but someone deleted my thread. -.-
So I messaged Wizzup? and he told me to post again to see what you guys think.

So, I cbf typing it all out again so I just posted the message I sent to Wizzup and his reply.

Thanks,
Turbobk.

Originally Posted by turbobk
Hi Wizzup?.

My name is Luke Jordan.

A few days ago I installed SCAR 3.15 on my sister's pc, and today I thought I might download subversion so I could download the newest SRL for her.

I did the normal installation and I opened SCAR then,
Tools > Options > SRL Download. I changed to 'Subversion Repository' and clicked 'Checkout'.

Then the CMD window opened and started to install SRL Revision #17, when it got to installing 'SCSS' the window closed and my sister's Antivirus program (ZoneAlarm Secuity Suite PRO, latest updates) popped up and said that a file in the SCSS folder was infected with a virus called 'Backdoor.Win32.Delf.ixb'.

I was very confused so I copyed the SCSS folder and RAR'ed it, then I scanned it on Jotti.org and it said it was Infected aswell. So I posted on the Forums in the General News section just to warn people and my thread got deleted.

I have made a quick video to show you exactly what happens. I have RAR'ed the .avi (31.6 Mb) to 452Kb, for ease of downloading and I have also scanned the .avi RAR folder on Jotti.org for your convenience.

I also took a picture of the scan for the 'SCSS' folder on Jotti.org

Link to Video (.avi): http://www.mediafire.com/?dmbnxm3bxlx

Link to Scan for Video (.bmp): http://i28.tinypic.com/zx4j8w.jpg

Link to Scan for SCSS (.bmp): http://i29.tinypic.com/dwt854.jpg


Thanks Alot for your time.
I just wanted you to check this out.

Thanks again,
TurboBk.

Originally Posted by Wizzup?
Who deleted your thread…? Odd.
I remember people mentioning these was a trojan on SCAR/SCSS sometimes, check out these threads:

http://www.srl-forums.com/forum/anyo...ht=scss+trojan
http://www.srl-forums.com/forum/scar...ht=scss+trojan

Hope that clears some stuff up…
Repost your thread anyway, we will see what other people think. Also, you might want to attach this message, so your thread won't be deleted again…

~Wizz

Might be a false alarm, don't worry about it :)


-Ashur

yes i believe it is a false alarm i know that sophos blocks and deletes scar.exe
took me about 4 hours to help someone install it overmsn and about 50 printscreens =]

Hmm. If it was SCSS I suggest just deleting it if your AV goes gay about it as it's not that necessary. Although SCSS is safe and coded by Freddy1990, atleast as far as I know, some AV's think it's a trojan, most likely because of it's behaviour (connects to the internet probably in a similar way that some trojan does).. Atleast I think :p

yes its jus avg that is gay about it all scar etc will have to have a backdoor coz of updates to svn etc etc and sel

Like ashur said it might be a false alarm Hopfuly it is :D

I got it yesterday too, it's just a false alarm…

My f-secure found a virus too…

Problably SRL community is trying to map all rs cheaters by infecting them with virus.

…

Edit in your firewall, make it allow the .exe and then see what happens

thats weird i have never had this problem when installing and i use AVG and Avast. has to be false alarm

Ok guys, thanks alot for the Information..

But the suspicious thing is, that it's not actually connecting to the internet at all, so my sisters antivirus wouldnt be flagging it as a virus because of that. It only finds the Backdoor when im actually installing it..

But if you guys are sure, then I'll take your word for it :p

Thanks alot for the help.

Sincerely,
TurboBk. :)

AVG for me, never does anything gay to me. Only detects REAL viruses… Nothing happens with AVG to scar or anything that all you guys say…