SHP Forums

They are on the SCI Tools page, but perhaps I can link it here, too, as this seems to be where most are getting it from.

Hi folks,

recently my virus scanner reported a TR/ATRAPS.Gen2 in the SCI Resource Viewer.
Obviously the file sv.exe is infected with a trojan.

Now I wonder, is there a way to get rid of this horse?

Greetings

netwarrior

False positive. Nobody else has had any trouble with it. Many here use it all of the time. Else it got infected on your machine.

netwarrior wrote:Hi folks,
recently my virus scanner reported a TR/ATRAPS.Gen2 in the SCI Resource Viewer.
Obviously the file sv.exe is infected with a trojan.
Now I wonder, is there a way to get rid of this horse?
Greetings
netwarrior

Like Collector said - doubt it was in the sv.exe - unless you got it from some abandonware site or some other questionable site.

As for getting rid of it - google the virus name. See if you find anything.

I've found it with Avira Antivir.
When I'm downloading the SCI Resource Viewer form the first page of this thread and scan the zip-file, it finds this trojan again.

http://www3.avira.com/en/support-threat ... 0/tlang/en

http://www.precisesecurity.com/trojan/tratrapsgen2/

The risk level is stated at low, but nonetheless.

Greetings

netwarrior

You can have your AV clean your machine, but far too many have obtained the Viewer from this thread that if it was truly infected someone else would have reported it. I just redownloaded it and scanned it with my Microsoft Securities Essentials and it came up clean. Most likely your AV is giving you a false positive.

Do you use McAfee? Because... strangely, Corp McAfee reports the same (here at work - will try Eset at home, which I trust above all else) -... I don't trust McAfee at all... so... who knows.

The transferred file contained a virus and was therefore blocked.
URL: http://sierrahelp.com/forums/download/file.php?id=14 (174.122.140.3)
User: - (129.46.24.236)
Policy: default (-)
Categories:
Virus Name: McAfeeGW: Trojan.ATRAPS.Gen2
File Name: file.php
Media Type: application/executable
Body Filter Rule:
Filter Name: Mobile Code Filter
Reputation: Neutral (0) (0)

Available Options:
TrustedSource.org Lookup site information in TrustedSource.
Email a site review request to (EMAIL REMOVED) Email a site review request to (EMAIL REMOVED).

Just as I figured. McAfee is reporting incorrectly. Because eSET (which updates automatically - but ran an update before downloading said file and did a scan). Comes up 100% clean with eSET, which I trust over everything else.

Which is exactly what the Microsoft Security Essentials showed, which is currently just about the highest rated AV. It is one of the most thorough and one of the least resource intensive and it doesn't suffer from the high level of false positives that many other AVs do. McAfee is just about the worst for false positives. A little research shows that Avira has a very high rate of false positives, too.

Checked it with different Virus Scanner on these sites:
http://www.virustotal.com and http://virusscan.jotti.org/com

It seem that my Virus Scanner is the only ones that detects it.
Like Collector says before, its probably a false positive.

Using this viewer myself for a long time and never had problems with it.

Sorry for this inconvience.

netwarrior

No problem. Better to have it reported and be a false positive than the other way around.

The creator of SCI Viewer appeared out of nowhere on the Janitorial Times once again and said that the source code is no longer available, but the latest version (version 2) he released for us. I'm not sure if this is different or the same from the version I have. It's two ZIP archives, one with command line tools and one with a GUI like the one I have. Made in 2008/08/08. I haven't bothered to check if my version is the same. I can upload it to my website and then whoever wants to host it can take it from there.

Here's the thread: http://forum.spacequest.net/viewtopic.p ... 0&start=40

I saw the post. He also apparently changed the links on the SCI wiki. I followed the links to dead links on RapidShare and assumed that it was spam, so I revered it back. I'll have to check the MD5 of them to see if they are the same as what is already uploaded.

Collector wrote:I saw the post. He also apparently changed the links on the SCI wiki. I followed the links to dead links on RapidShare and assumed that it was spam, so I revered it back. I'll have to check the MD5 of them to see if they are the same as what is already uploaded.

Did you ever get them (since you said they were dead links?)

If not - I got them if you need them. They're very small files.

Here's the files I acquired from his rapidshare links.

http://brandonblume.com/games/sv_cli.zip
http://brandonblume.com/games/sv_gui.zip