File damaged or infected by virus

[badnews]

I have just done a reinstall of Windows on my XP Service pack 3 machine, I've downloaded bit che latest version from your site but whenever I try to run it it comes up with the message:

File damaged or infected by virus

Any idea how to sort this out? I have formatted the harddrive and reinstalled windows 3 times now but keep getting the same error, I am having no other errors with the computer?

Cheers

[Bovski]

This is covered in a stickie
http://convivea.com/forums/index.php?topic=1369.0


http://www.youtube.com/watch?v=B9q2jNjOPdk#noexternalembed

[chip!]

hmm.. the .exe should report this message if it has been modified..

upload "C:\Program Files\Bit Che\Bit_Che.exe" to http://www.virustotal.com

and report back to me the "MD5" it tells you..

[zbeast]

Avast alert me when doing an update in Bitche. The log:
  5/1/2009 5:42:38 PM SYSTEM 1396 Sign of "Win32:Trojan-gen {Other}" has been found in "C:\Users\bigkitty\AppData\Roaming\Convivea\Bit_Che\scripts\special.exe" file.

This is a real virus not a false report..
The virus was run and it does download crap to the computer under test.

[chip!]

zbeast, thats definitely a false report. Avast reports all files packed with "FSG" as having signs of "Trojan-gen [other]".

Looks like you should update your virus definitions because virustotal is reporting that Avast is not reporting "special.exe" as a virus anymore?

Please see:   http://www.virustotal.com/analisis/914ff2f40ec263e0f9395e42d88819e4

Also, "special.exe" does NOT run on your computer unless you are configuring your login account for certain private sites that require a special login method. Special.exe uses Internet Explorer so maybe thats why you're thinking it downloaded something to your computer..  but that doesnt make sense.  I bet what happened was you did the Bit Che Script update (which installs an updated version of special.exe, but does not run it).. and then Avast then gave you that false report.

Anyway, as usual, upload your "special.exe" to virustotal.com and compare hashes:

MD5...: 1901ea2b2dc18d22b73a1d5242b56264
SHA1..: f069b396a2de076236a93dce184b168930f3ee37
SHA256: df998d1416b80309ae9d77349f1ef1594a99b95d1e9c03f283c65a04ea5a5429

All of Bit Che's executables should not run if they are modified by a virus, so you can be rest assured that Bit Che is virus free.

Thanks,
chip