Hi all;

my Kaspersky AntiVirus just reported

Trojan-Downloader.Win32.Delf.hgd in ChaosUpdater.exe
Hoax.Win32.Agent.dh in apmalert.bwl

ChaosLauncher version was 0.4.1.0.

The above malware signatures were only added recently, so I guess that is the reason why Kaspersky only discovered this now.

Anyone know more?

SnowFantasy

4173 Posts

July 01 2008 07:17 GMT

Ignore it. :D

edit: wait there have been threads about this type of thing. one second

http://www.teamliquid.net/forum/viewmessage.php?topic_id=71173

I'm guessing same sort of thing here.

anotak

United States1537 Posts

July 01 2008 07:24 GMT

No, this is wrong. This is a false positive due to heuristics used in antivirus software... Chaoslauncher does things that are virus-like (downloads updates and runs them, hooks into other software on your computer (specifically Starcraft), and hooks the keyboard). False alarm. Chaoslauncher contains no malware.

minus_human

4784 Posts

July 01 2008 07:24 GMT

I don't care. I trust ChaosL

Aerox

Malaysia1213 Posts

July 01 2008 07:39 GMT

On July 01 2008 16:24 minus_human wrote:
I don't care. I trust ChaosL

haha

Metaspace

Austria670 Posts

July 01 2008 07:41 GMT

On July 01 2008 16:24 anotak wrote:
No, this is wrong. This is a false positive due to heuristics used in antivirus software... Chaoslauncher does things that are virus-like (downloads updates and runs them, hooks into other software on your computer (specifically Starcraft), and hooks the keyboard). False alarm. Chaoslauncher contains no malware.

Well this seems plausible, but stating "this is wrong" without proof seems a bit overhasty to me.

anotak

United States1537 Posts

July 01 2008 07:45 GMT

On July 01 2008 16:41 Metaspace wrote:

Show nested quote +

Well this seems plausible, but stating "this is wrong" without proof seems a bit overhasty to me.

This issue has been brought up before concerning ChaosLauncher.

And I know other software that has been affected by similar issues.
Nothing to be worried about.

MasterOfChaos

Germany2896 Posts

July 01 2008 07:58 GMT

Download the latest launcher, there the updater is suspicious for fewer scanners. You can also look at the source at http://winner.cspsx.de/Starcraft/Tool/Source.rar
Why the updater is suspicious is beyond be, because all it does is copy files from the temp directory to the chaoslauncher directory and restart the launcher.
On the other hand almost no scanner detects Chaosplugin as a keylogger which it technically is(The block windows-keys function is similar to a keylogger except it does not log).

Deimos0

Poland277 Posts

July 01 2008 20:06 GMT

My Nod32 doesn't find anything suspicious

DIGID

United States6 Posts

July 13 2008 23:10 GMT

#10

My avast! Antivirus detected a trojan virus in both the APM Alert plugin and ChaosUpdater. I deleted them. I'm not sure if I have the latest version anymore either. I think I have 0.5.1.

ShaLLoW[baY]

Canada12499 Posts

July 13 2008 23:25 GMT

#11

It's not a trojan , did you even read this thread before posting here?

R1CH

Netherlands10341 Posts

July 13 2008 23:27 GMT

#12

It seems anything made with pascal(?) is a "virus" these days, both chaosupdater and apmalert use the borland runtime / linker at least.

HeavOnEarth

United States7087 Posts

July 14 2008 00:25 GMT

#13

just chill its nothing serious
hell you have Kaspersky, greatest antivirus of all time
but it fucking overreacts on everything ;D just add to safe please~ no one has ever been infected before ( or reported it ) so.. chill~ false alarm

IzzyCraft

United States4487 Posts

July 14 2008 01:44 GMT

#14

Lol you know you can mark it not a virus its common to have something that is 3rd party esp something that hook on to programs seem like a problem in a scanners eyes. I trust masterofchaos, anyways what would he benefit by it being malwear.

MasterOfChaos

Germany2896 Posts

July 15 2008 08:48 GMT

#15

On July 14 2008 08:10 DIGID wrote:
My avast! Antivirus detected a trojan virus in both the APM Alert plugin and ChaosUpdater. I deleted them. I'm not sure if I have the latest version anymore either. I think I have 0.5.1.

Do that if you want, but don't complain to me if it does no longer start once it tries to install the next update.

vhallee

899 Posts

July 15 2008 10:22 GMT

#16

a bit offtopic but my chaos launcher makes my starcraft crash whenever i create game. i just go bnet, hit 'create' and then i get the send/dont send error message :/ any idea why?

MasterOfChaos

Germany2896 Posts

July 15 2008 12:28 GMT

#17

Which plugins are you using? Some are incompatible. Especially the AdvBnet plugin dislikes several other plugins.

vhallee

899 Posts

July 15 2008 12:51 GMT

#18

On July 15 2008 21:28 MasterOfChaos wrote:
Which plugins are you using? Some are incompatible. Especially the AdvBnet plugin dislikes several other plugins.

well i have all the plugins that are available with the latest version. i will try unchecking advbnet and see if it works.

EDIT: that was it! that advbnet plugin is the problem. i unchecked it and it works. thanks alot! =)

oh and btw fix it :D

Equinox_kr

United States7395 Posts

August 23 2008 20:15 GMT

#19

Hm, Chaoslauncher was working fine until about a few weeks ago.

When I start it up, an error message in German appears and if I press OK it'll run Starcraft. But that's not the problem.

My NOD32 has never mentioned anything about Chaoslauncher containing a virus but APMAlert.bwl has been freaking it out. Just to be safe I deleted it and I was going to get a fresh copy of Chaoslauncher. When I downloaded that my NOD32 freaked out again.

Somebody reassure me here lol

SonuvBob

Aiur21550 Posts

August 23 2008 20:22 GMT

#20

YOU'RE GOING TO DIE

Durak

Canada3685 Posts

August 23 2008 21:34 GMT

#21

Mine works great. Chaoslauncher is elite.

tec27

United States3702 Posts

August 23 2008 21:37 GMT

#22

There shouldn't be any problems with it. I've been meaning to update APMAlert so it wouldn't cause alerts like that (and I actually did, but haven't finished updating it all yet so that I can upload a new version). So hopefully, once I do that, it'll fix any other alerts like that.