Welcome, Guest. Please login or register.
Did you miss your activation email?
May 23, 2013, 01:23:33 PM

Login with username, password and session length

663786 Posts
70588 Topics
145226 Members

Latest Member: oldwiseowls

Search:     Advanced search | Tag Cloud
+  Welcome to the Comodo Forum
|-+  Security Products & Services
| |-+  Comodo Internet Security - CIS
| | |-+  Help - CIS
| | | |-+  Defense+ / Sandbox Help - CIS
| | | | |-+  Win Movie Maker Portable malware?
« previous next »
Pages: [1] Go Down Print
Author Topic: Win Movie Maker Portable malware?  (Read 1459 times)
brightness
Comodo Loves me
****
Offline Offline

Posts: 153


« on: February 29, 2012, 02:47:38 PM »

Hi all,

I have downloaded portable Windows Movie Maker 2.6 from CNet. As per instructions, I ran the runonce.exe after extracting the zip file. I think programs from CNet are certified virus- and malware-free. However, D+ says the runonce.exe is a trojan.

Can anyone confirm if this is a false positive or it is really a trojan?

Download site:

http://download.cnet.com/Portable-Movie-Maker/3000-13631_4-10913520.html

Thanks.
Logged
L.A.R. Grizzly
Star Group
Comodo's Hero
*****
Offline Offline

Posts: 1511


Akron, Ohio, USA


WWW
« Reply #1 on: February 29, 2012, 02:56:12 PM »

Hi all,

I have downloaded portable Windows Movie Maker 2.6 from CNet. As per instructions, I ran the runonce.exe after extracting the zip file. I think programs from CNet are certified virus- and malware-free. However, D+ says the runonce.exe is a trojan.

Can anyone confirm if this is a false positive or it is really a trojan?

Download site:

http://download.cnet.com/Portable-Movie-Maker/3000-13631_4-10913520.html

Thanks.

Lower on down the c/net page shows others have also found a virus, I would be careful.

VirusTotal gives it about a 50% chance of being infected:

https://www.virustotal.com/file/c3a2e5d57c3a9003b27ccd5e9206e20a3dbccc134435399af279590321a28e54/analysis/

VirScan.org has about 50%:

http://r.virscan.org/report/f9abf4b65ce62b7e2e6fe27704639fca.html

You can submit the file to Comodo for their full analysis:

http://www.comodo.com/home/internet-security/submit.php
« Last Edit: February 29, 2012, 03:22:24 PM by L.A.R. Grizzly » Logged

Win7 Pro SP1 32 Bit - WinXP Pro SP3 32 Bit
CIS 6.1.276867.2813
Firefox and Thunderbird
Toolbar Icon Themes for Firefox and Thunderbird
wasgij6
Global Moderator
Comodo's Hero
*****
Offline Offline

Posts: 3061



WWW
« Reply #2 on: February 29, 2012, 03:05:24 PM »

The download says the CNET installer is enabled. This will try and install a toolbar and change your homepage. Try downloading it without the CNET installer.
Logged

| Win 7 Ultimate (x32) SP1; Admin | UAC Disabled | CIS 6.1.276867.2813 | CD 26.2 | CID 20.0.1 | VMWare Workstation; XP (x32), 7 (x64) |
brightness
Comodo Loves me
****
Offline Offline

Posts: 153


« Reply #3 on: February 29, 2012, 03:13:15 PM »

Thank you L.A.R.Grizzly and wasgij6

1. I actually tried the virustotal analysis. However, I can not be sure as running an avast scan does not indicate it is a virus.

2. I downloaded the program without the toolbar. (most toolbars are nightmares, you know!)

Thanks.
Logged
L.A.R. Grizzly
Star Group
Comodo's Hero
*****
Offline Offline

Posts: 1511


Akron, Ohio, USA


WWW
« Reply #4 on: February 29, 2012, 03:18:56 PM »

The download says the CNET installer is enabled. This will try and install a toolbar and change your homepage. Try downloading it without the CNET installer.

Look directly below that button for a direct download link.
Logged

Win7 Pro SP1 32 Bit - WinXP Pro SP3 32 Bit
CIS 6.1.276867.2813
Firefox and Thunderbird
Toolbar Icon Themes for Firefox and Thunderbird
brightness
Comodo Loves me
****
Offline Offline

Posts: 153


« Reply #5 on: February 29, 2012, 06:45:22 PM »

Look directly below that button for a direct download link.

Thanks.

As my previous post said, I used the direct download link and downloaded the program without the toolbar. For me, most toolbars or BHOs are nightmares!
Logged
Tags:
Pages: [1] Go Up Print 
« previous next »
Jump to:  

SSL Certificate Free Virus Removal Firewall
Page created in 0.061 seconds with 23 queries.
Powered by SMF 1.1.18 | SMF © 2006, Simple Machines Design by 7dana.com