Warning - W32.Rontokbro@mm worm in BSCMEGAProps_MJB_Vol2.exe

[TheMurderousCricket 5,109]

Warning to all the modders and a heads-up for the Admins.

I have run an anti-virus scan on one of my flash drives, and it has discovered a Win32/Brontok family worm in the BSCMEGAProps_MJB_Vol02 installer.

Note that I am not referring to the installer per se. The file is actually embedded inside the installer. W32.Rontokbro@mm is a known threat and not a false-positive. It is not a part of the original file.

I recommend anyone using this file to scan your system if you don't do it regularly after downloading. Again, this is a known threat and there is absolutely no reason why you should tolerate it on your system.

[Tarkus 6,933]

As this file appears to be available only on the SC4D LEX, not here on the STEX, I thought I'd jump in. 

First thing I did was pull the copy of the full .zip file I have into VirusTotal, which is an online aggregator of anti-virus results--here's the results.  Of the 65 anti-virus products, only two more obscure ones (Jiangmin and Zillya) flagged it, with the first believing it to be "Adware.Agent.lb", and the second claiming it contained "Trojan.Keylogger.Win32.3748".  All the others--including the major commercial ones (i.e. Symantec/Norton, McAfee, Kaspersky)--say it is clean.

Running the installer itself through VirusTotal aggregated 60 anti-virus systems, and the end result was that 3 of the 60 flagged it--in addition to Jiangmin and Zillya again, one called "TheHacker" called it "Trojan/generic".  Those results are here.

I also personally scanned it on my end using Windows Defender (Windows 10 version) and Malwarebytes.  Both gave the installer a clean bill of health.  None of the results with that or with the VirusTotal aggregates made any reference to Rontokbro or any sort of Brontok worm.  While Rontokbro/Brontok are indeed real viruses, it is still quite possible for false positives to list real viruses, rather than things that are clearly marked as probability-based "reputation" threats, and Rontokbro happens to be the most common real virus to get invoked in false positives involving SC4 plugin installers.

I will note that we are preparing to eliminate most of the installers on the LEX (primarily the notorious ClickTeam ones that are used by most LEX files) as part of the Project ZIP effort, which @Tyberius06 has been absolutely instrumental in getting together, and has been quite a monumental undertaking.  That file will be among the ones that is going to be converted to a simple .zip file.  I've run the current version of the new package through VirusTotal as well, and it's completely clean.

I'm very certain that this is a Rontokbro false positive, but if it still remains a concern to you, go ahead and delete the file and replace it with the purely .zip version once it's on the LEX.  The main reason we're doing Project ZIP is to simplify bulk installation, and allow for full-on plugin packs to be easily assembled on-site using the Dependency Tracker, but eliminating the potential for anti-virus ire was also seen as another huge positive. 

-Tarkus

 

 

[TheMurderousCricket 5,109]

Thanks for your input @Tarkus. The thing is that it was my Norton that discovered this worm burrowed into the installer.

I believe that this Brontok is either there in the installer, or it somehow infiltrated one of my other systems (XP or Mac being the other two) and attached itself to the installer.

In any case, I hope it serves either as a warning or a case study that this virus can latch onto something and make its way into the system.

EDIT: Now that I think of it, it could have happened after I have installed the BSC pack... After running the installer I did not notice anything suspicious. Perhaps it entered the installer afterwards, waiting to strike should I run it on another machine. Phew!