in_mpc.dll: Trojan.Flood.22016 FOUND

2004-04-21 15:45:18

well, i put most of my problem in the title...

i did a virus check on my 'puter with ClamWin (opensource) and it said that winamp's in_mpc.dll had some kind of trojan in it.

my computer's been stable, and i'm not worried, but i'm curious as to whether this is a false-positive from the virus checker, or maybe there's really something up with in_mpc.

i have 2 installs of winamp (2.8 and 5) with this plugin, and they both were found by the scanner.

in_mpc.dll: Trojan.Flood.22016 FOUND

is anyone aware of this issue?  or should i re-download this plugin and scan again?

in_mpc.dll: Trojan.Flood.22016 FOUND

Reply #1 – 2004-04-21 15:50:51

From where did you dowload that file ? Could you please post md5 hashes for the suspicious files ?
Try some other antivirus software as well. TrendMicro Housecall is a free online scanner for example.
Probably and hopefully it's a false positive.
The one I use:

Winamp musepack plugin 0.96 (date 2002_07_07  124416 bytes):
1D2176124607BB2BDED6BCE1A322619C  in_mpc.dll

in_mpc.dll: Trojan.Flood.22016 FOUND

Reply #2 – 2004-04-21 16:31:50

they're both:

98DEF7244192932D1BA56D40D593505E

hmm.  that's different to yours.  i'll try download again from rarewares.

i used "DAMN Hash Calculator" to generate that line.  not sure if this is much good or not...

[edit]

the rarewares download for in_mpc_0.99d_alpha has the same checksum.  i guess it's a false positive.

in_mpc.dll: Trojan.Flood.22016 FOUND

Reply #3 – 2004-04-21 18:09:30

Clam AV got a pretty devastating result in a recent c't review. Their reaction time for new viruses is way too slow, therefore it has a bad detection rate with most newer viruses (and the new ones are always the most common ones around). Ok, it's Opensource and still in early stages, so that's excusable, but i wouldn't use it as a serious AV program yet. Maybe you should make a Bugreport about a false positive.

in_mpc.dll: Trojan.Flood.22016 FOUND

Reply #4 – 2004-04-22 06:18:50

good thinking... i was wondering whether to report that.

i know it's a pretty limited program... but i'm getting behind opensource (and my norton license expired, and i was too lazy to renew it)

in_mpc.dll: Trojan.Flood.22016 FOUND

Reply #5 – 2004-04-22 07:29:31

Try your file with these two AV packages, they are both free (as in free beer) and pretty updated:

AVG FREE Edition
Antivir Personal edition

in_mpc.dll: Trojan.Flood.22016 FOUND

Reply #6 – 2004-04-22 07:44:00

Another good freeware virus scanner is eScan Antivirus Toolkit Utility which is powered by Kaspersky Antivirus, it's free and is updated each week.

in_mpc.dll: Trojan.Flood.22016 FOUND

Reply #7 – 2004-04-22 09:21:31

It that HASH calculator complies with the RFC, it will produce identical results to any other MD5 hasher. If you aren't sure, try these:
Fourmilab MD5 Which is very quick
Windows GNU utils Which is a port of the GNU version

You could mail that file to me, or put it on some web space (uploading here probably isn't wise) and I could scan it for you with the latest Norton and McAfee.

in_mpc.dll: Trojan.Flood.22016 FOUND

Reply #8 – 2004-04-22 10:49:37

I also recommend AntiVir Personal Edition - definition files are updated daily(!)

in_mpc.dll: Trojan.Flood.22016 FOUND

Reply #9 – 2004-04-22 14:28:09

i'm not too worried about current virus checkers - i'm firewalled, and i don't open spam, so i feel i'm protected as well as i can be.

i've submitted a report to the clamwin guys.  we'll see what happens