![]() |
![]() | Trojan.Mybot - Big Fish Games | ![]() |
![]() |
![]() | ![]() |
GuitarBob
![]() |
![]() |
The detections could very well be a false positive--especially if you have used the games before without any problems. This can happen with any antivirus from time-to-time. What you should do is upload each game (one at a time) to the Jotti scanning service at https://virusscan.jotti.org/ on the Web and see what other antivirus programs say about the file(s). If several other AVs find a file is infected, it probably is. If only a couple of other AVs find an infection, it is probably a false positive, and you should go to the Clam virus submission page at https://cgi.clamav.net/sendvirus.cgi and fill out the form. Be sure to check the False Positive box, and tell them the name of the false detection in the notes box. You will be helping to make Clam/ClamWin better.
Regards,l |
|||||||||||
|
![]() |
![]() | ![]() |
care4turtles
![]() |
![]() |
Ran Jotti's malware scan on 2 of the games.
Both of their status: INFECTED/MALWARE (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database) Scanner results CPsecure Found RiskTool.W32.PsKill.Q So, This means it is indeed infected?? Not a False Positive? Also, Sounds like it may be in ClamWin database already too?? GEEZZZZZ ![]() ![]() |
|||||||||||
|
![]() |
![]() | Re: Trojan.Mybot - Big Fish Games | ![]() |
b0ne
![]() |
![]() |
It would appear to be a false positive, however, there are some concerning things about this company: 1) Magic-Match can be downloaded and played without installing the third party "big fish" software. 2) The file name that they're using is essentially a non-sensical randomized name. One of the typical reason to randomize a file name is to attempt to hide something.... be it hiding a file name from an anti-malware program or a tool that targets a file by name. 3) The file has been wrapped in a pretty complicated "application protector" called https://www.siliconrealms.com/index.shtml Armadillo. 4) The bfgservice.exe program seems to re-launch this "rfxgdvv.exe" on a regular basis, and every time a game is run. A runtime log was recorded using "Process Monitor" from sysinternals, and it does not appear to make any changes to your system, it merely seems to be some sort of licensing enforcement module which coincides with it being "protected" by Armadillo. |
|||||||||||||
|
![]() |
![]() | Trojan.Mybot - Big Fish Games | ![]() |
|
||
![]() |
![]() |
Powered by phpBB © phpBB Group
Design by phpBBStyles.com | Styles Database.
Content © ClamWin Free Antivirus GNU GPL Free Software Open Source Virus Scanner. Free Windows Antivirus. Stay Virus Free with Free Software.
Design by phpBBStyles.com | Styles Database.
Content © ClamWin Free Antivirus GNU GPL Free Software Open Source Virus Scanner. Free Windows Antivirus. Stay Virus Free with Free Software.