Old 17th August 2006, 18:09   #1
dlkita
Junior Member
 
Join Date: Aug 2006
Posts: 1
F-secure claims Winamp 5.24 full dload is infected

Greetings,

apologies for making this my first post. I am helping a friend with setting upp his computer and I have installed WinAmp from this URL http://download.nullsoft.com/winamp/...usic-7plus.exe

However, F-secure 2005 with latest definition file updates claims that the download contains a malware inside of it - it is present both in the downloaded file and in the temp-dir of the installation.

The name of the virus is Trojan-Downloader.Win32.Small.dna per the F-scure screens. The description of the virus is here:

http://www.f-secure.com/v-descs/small_coy.shtml

The size of the downloaded file is 6206440 bytes.

md5 checksum:

user@host $ md5sum -b winamp524_full_emusic-7plus.exe
157fdc6ad9b57567cf1fb0644978d975 *winamp524_full_emusic-7plus.exe

is this an error in F-secure or is the download indeed infected?

Edit: as F-secure stops the virus from activating, the installation of winamp succeeds and the installed software is not infected.

Thanks,

/dlkita
dlkita is offline   Reply With Quote
Old 17th August 2006, 18:30   #2
drewbar
Sawg 2.0
Major Dude
 
Join Date: Mar 2004
Posts: 5,916
F-Secure is wrong. As long as you download Winamp from the offical site, it is garunteed to be virus free. Not too much of a shock though, anti-virus programs love to hate on the NSIS installer.

http://nsis.sourceforge.net/NSIS_False_Positives
Time to add F-Secure to the list.

Count with us!
Jan 1st, 12AM (PST, GMT -8) 2010 - 282,246
drewbar is offline   Reply With Quote
Old 17th August 2006, 19:15   #3
DJ Egg
Techorator
Winamp & Shoutcast Team
 
Join Date: Jun 2000
Posts: 35,866
Report the false-positive to Anti-Virus-Support@F-Secure.com
DJ Egg is offline   Reply With Quote
Old 17th August 2006, 20:03   #4
tedi97
Junior Member
 
Join Date: Aug 2006
Posts: 3
Kaspersky refused me to download Winamp524???

I can't download Winamp524, and got message from my Kaspersky program :

The is written that there are some Trojans...
(The name of the virus is Trojan-Downloader.Win32.Small.dna




WHAT HAPPENDS, PLEASE, Help !!


Kaspersky Anti-Virus 6.0

The requested URL http://download.nullsoft.com/winamp/...usic-7plus.exe is forbidden :

Last edited by tedi97; 17th August 2006 at 20:28.
tedi97 is offline   Reply With Quote
Old 17th August 2006, 20:27   #5
DJ Egg
Techorator
Winamp & Shoutcast Team
 
Join Date: Jun 2000
Posts: 35,866
Report it to Kaspersky. There's nothing anyone here can do about it. All the Winamp installers on winamp.com are certified malware free.
DJ Egg is offline   Reply With Quote
Old 17th August 2006, 20:29   #6
tedi97
Junior Member
 
Join Date: Aug 2006
Posts: 3
Thanks..i will report it to Kaspersky!
tedi97 is offline   Reply With Quote
Old 17th August 2006, 20:35   #7
Benski
Ben Allison
Former Winamp Developer
 
Benski's Avatar
 
Join Date: Jan 2005
Location: Brooklyn, NY
Posts: 1,057
Some virus is probably using similiar code as our auto-downloader for the windows media codecs (which uses justin's nsisdl plugin). A quick google for "nsisdl" finds that other NSIS installers are plagued by the same false positive.

Either that, or someone thinks the windows media codec library is a trojan
Benski is offline   Reply With Quote
Old 18th August 2006, 09:22   #8
tedi97
Junior Member
 
Join Date: Aug 2006
Posts: 3
Got answer from Kasperski!

Problem is solved! I have got from Kasperski instructions to download new version 6.0.0303.
Now is everything OK!!!
tedi97 is offline   Reply With Quote
Reply
Go Back   Winamp & Shoutcast Forums > Winamp > Winamp Technical Support

Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump