[Archive] Zmutfx's ModelEditFix Trojan, pics inside.
[Archive] Zmutfx's ModelEditFix Trojan, pics inside.
11-04-2025, 11:05 AM
Original source
Quote:When I first downloaded it, nothing happened, but a few days and an Avast! update later I opened my model edit WoW folder and.....
"Win32:Runner-N [Trj]" has been found in "C:\World of Warcraft ME\ModelEditFix.exe" file.
Lots of others have been posting that it has a virus and this is MY proof that there is one, I had no paranoia there was one before this happened.
Then, I thought, "Maybe it gained the trojan later? Maybe my PC is infected?" so I went to the Model Edit Fix sticky and tried downloading it again. Results below:
![[Image: gqzcnefxyx.jpg]](http://static.filefront.com/images/personal/f/Froogle/23386/gqzcnefxyx.jpg)
![[Image: pfpwwfdldv.jpg]](http://static.filefront.com/images/personal/f/Froogle/23386/pfpwwfdldv.jpg)
rektbyfaith
11-04-2025, 11:05 AM #1Archived author: Froogle • Posted: 2025-11-04T12:05:49.141619
Original source
Quote:When I first downloaded it, nothing happened, but a few days and an Avast! update later I opened my model edit WoW folder and.....
"Win32:Runner-N [Trj]" has been found in "C:\World of Warcraft ME\ModelEditFix.exe" file.
Lots of others have been posting that it has a virus and this is MY proof that there is one, I had no paranoia there was one before this happened.
Then, I thought, "Maybe it gained the trojan later? Maybe my PC is infected?" so I went to the Model Edit Fix sticky and tried downloading it again. Results below:
11-04-2025, 11:05 AM
Original source
Quote: if you read one of the other 20 topics on this you will know that it is not a trojan and if you want to be sure you can find the source and compile your own.
rektbyfaith
11-04-2025, 11:05 AM #2Archived author: reflex0rzor • Posted: 2025-11-04T12:05:49.141619
Original source
Quote: if you read one of the other 20 topics on this you will know that it is not a trojan and if you want to be sure you can find the source and compile your own.
11-04-2025, 11:05 AM
Original source
Quote: Yes but I'm just refreshing the topic with more proof . . . I'm not going to use this until it shows clean in a later version.
rektbyfaith
11-04-2025, 11:05 AM #3Archived author: Froogle • Posted: 2025-11-04T12:05:49.141619
Original source
Quote: Yes but I'm just refreshing the topic with more proof . . . I'm not going to use this until it shows clean in a later version.
11-04-2025, 11:05 AM
Original source
Quote: Its just something that avast updated what makes modeledit fix look like a virus, as you can see the file is 3kb big, no real virus/keylogger could fit in that, ive never seen
modeleditfix trying to connect any internet service nor anyother service in my computer... this means it doesnt matter if it gets your password cause it has no way to send it forwards..
This is same as anti virus detects packet sniffers/ editors as a virus due to that they are able to do serious shit..
and as you can see from source code there is nothing "scary" in there
rektbyfaith
11-04-2025, 11:05 AM #4Archived author: Teaparty • Posted: 2025-11-04T12:05:49.141619
Original source
Quote: Its just something that avast updated what makes modeledit fix look like a virus, as you can see the file is 3kb big, no real virus/keylogger could fit in that, ive never seen
modeleditfix trying to connect any internet service nor anyother service in my computer... this means it doesnt matter if it gets your password cause it has no way to send it forwards..
This is same as anti virus detects packet sniffers/ editors as a virus due to that they are able to do serious shit..
and as you can see from source code there is nothing "scary" in there
11-04-2025, 11:05 AM
Original source
Quote: As far as I've seen, only Avast gives this false posative. Dame good thing I don't use Avast anymore.
rektbyfaith
11-04-2025, 11:05 AM #5Archived author: Demonkunga • Posted: 2025-11-04T12:05:49.141619
Original source
Quote: As far as I've seen, only Avast gives this false posative. Dame good thing I don't use Avast anymore.
11-04-2025, 11:05 AM
Original source
Quote: Win32.Runner because its uses CreateProcess to execute the WoW client. No, it isn't a trojan. Reguardless of what any AV program says.
rektbyfaith
11-04-2025, 11:05 AM #6Archived author: JimbobGo • Posted: 2025-11-04T12:05:49.141619
Original source
Quote: Win32.Runner because its uses CreateProcess to execute the WoW client. No, it isn't a trojan. Reguardless of what any AV program says.
11-04-2025, 11:05 AM
Original source
Quote: i know this aint got a virus in it as iv used for ages and never got problem before, its only now my Avast has updated -.- need to find a way to solve this problem
rektbyfaith
11-04-2025, 11:05 AM #7Archived author: Mercer • Posted: 2025-11-04T12:05:49.141619
Original source
Quote: i know this aint got a virus in it as iv used for ages and never got problem before, its only now my Avast has updated -.- need to find a way to solve this problem
11-04-2025, 11:05 AM
Original source
Quote: any1 know a thread you can send me to so i can see how i fix this problem so avast dont say its a trojan?
rektbyfaith
11-04-2025, 11:05 AM #8Archived author: Mercer • Posted: 2025-11-04T12:05:49.141619
Original source
Quote: any1 know a thread you can send me to so i can see how i fix this problem so avast dont say its a trojan?
11-04-2025, 11:05 AM
Original source
Quote: Turn off resident scanner.
rektbyfaith
11-04-2025, 11:05 AM #9Archived author: Froogle • Posted: 2025-11-04T12:05:49.141619
Original source
Quote: Turn off resident scanner.
11-04-2025, 11:05 AM
Original source
Quote: Avast and AVG also found "trojans and viruses" in blizzards own patches downloaded via the blizzard downloader, straight from blizzards pages, some time ago. It got fixed when blizzard contacted the companies and asked for a hotfix.
False positives FTL.
It's safe.
rektbyfaith
11-04-2025, 11:05 AM #10Archived author: Aqqu • Posted: 2025-11-04T12:05:49.141619
Original source
Quote: Avast and AVG also found "trojans and viruses" in blizzards own patches downloaded via the blizzard downloader, straight from blizzards pages, some time ago. It got fixed when blizzard contacted the companies and asked for a hotfix.
False positives FTL.
It's safe.
Recently Browsing
1 Guest(s)
1 Guest(s)
Recently Browsing
1 Guest(s)
1 Guest(s)