W32/Sdbot.worm.gen.a

[valhall4]

It's really nice to watchow GCW turns into a scrapheap of viruses and malwares. How pityful.

http://m0003.gamecopyworld.com/games/pc_mercenaries_2.shtml
(Mercenaries 2: World in Flames v1.0 +9 TRAINER)

[Nihilanth]

Some virus programs say that some of the trainers are virii or trojans but that's not always true, I know some of the files do contain virii, but I've downloaded tons of cracks, they all work perfectly. I tend to stay away from the trainers, though.

[nando2002]

Avast reports (only after run it): Win32:VB-JYT [Drp] (Malware Type: Dropper)
In the Temp folder there's a new file named "decrypted.exe" (with the jpeg icon) which contains the worm: Win32:IRCBot-BSX [Wrm]
Anyway, the trainer is in the temp folder but also contains a trojan: Win32:NaviPromo-CN [Trj]

This trainer "repacked" is more like a virus store house than a trainer.

[Joe Forster/STA]

Next time, read the forum FAQ and have the file analyzed with a multi-engine scanner, too. Here are the results: http://www.virustotal.com/analisis/e3b4819cc975932830cdf1689d860ba3 . Quite a few scanners report malware but none of AVG, Kaspersky, NOD32 do. I say: inconclusive.

[nando2002]

Sorry to question your answer Joe but can you explain the "decrypted.exe" file in the temp folder?
In my Virtual Machine with no Internet Access after running the bws-mc2re.exe it reports: "MSVCRT71.dll not found" and a new "bws-mc2re.exe" is created in the temp folder which is the trainer.
There's a difference of size also: if you download from GCW, the exe size is 592203 bytes but after run it, the new trainer size is 58368

[EMPiRE]

It sounds suspicious enough

I've replaced it with the real trainer...

This is one of the problems when ignoring warnings when you get so many false alarms...

We have to accept that malware spread thru trainers & other executables are too recent for most AV... thus they will not be detected fast enough!

It is too bad that until recently we only had about 2-3 infected files over the past 9-10 years, now we are getting about 1 a day...

[Nihilanth]

Whoa, I don't get it, what's the point of creating trojans as trainers.
Chances are, people that found this site, probably know how to handle virii trojans etc,
so what do they aim to achieve other than to waste the downloaders time?

[Joe Forster/STA]

@nando2002: Oh, I only wrote "inconclusive", I dared not run it... ;)

@Nihilanth: Spreading malware is fun. (If not for commercial purposes, such as zombie nets used for cracking, spamming etc.) If you don't understand why, don't worry, many people don't either: it's some kind of a weird way of creativity by otherwise talented people...

[DABhand]

Its also pityful that the Original Poster was a prat :P

Whats pityful is he has been using the site for a time now and for free but yet he has the gall to say GCW is pityful, he is pityful more like.

All he had to do was say that he picked up something suspicious and people would have checked and thanked him, but no he had to try and look superior and act like a tit.

Ahh well such is kids these days.

[Joe Forster/STA]

... especially that the word is correctly written "pitiful"... ;)

[TippeX]

yeh i think the pityful is an americanism.. still sort of valid, but then you have to use yank speek :)

[Nihilanth]

Yes, well, thank goodness for sites like this. Free, uncomplicated, virus-free(Well, mostly, I haven't run into one.)

How do you know the guy has been using the site?

[DABhand]

He knew GCW was tied with FF to post here about it, and he did suggest he has been using the site for a while in his post.

[nando2002]

He may get upset because that trojan/worm infect MSN Messenger & AIM and he get infected.
Anyway, I think the info in the main screen in GCW should include something like: none of the files included here were tested by any member of GCW. use it at your own risk.

[EMPiRE]

I fully understand that someone gets upset over being infected but then again you should never assume anything anymore...

There is already a disclaimer available (it has been there forever), which should be enough