Posted March 01, 2014
I'm not really familiar with antivirus programs (I use Macs), but I decided I should take some more precautions with my computer's health and downloaded ClamXav (opensource). The first file that showed up with an "infection" was Castles 1 and 2.app with the "infection" "Win.Trojan.Chiton-167 .
I don't know if this is a false positive, or how it could occur that Castles has a trojan, so maybe someone could inform me just what may have gone on.
Only experienced users should comment, please, no baseless speculation…
Later…
Okay, so I scanned through the log file (so tedious… -- should've done a string search) and here are the relevant files:
/Users/username/Applications/Wineskin/Castles 1 and 2.app/Contents/Resources/drive_c/Program Files/Adobe/Reader 9.0/Reader/plug_ins/AcroForm/PMP/AdobePDF417.pmp: Win.Trojan.Chiton-167 FOUND
/Users/username/Applications/Wineskin/Castles 1 and 2.app/Contents/Resources/drive_c/Program Files/Adobe/Reader 9.0/Reader/plug_ins/Multimedia/MPP/Flash.mpp: Win.Trojan.Chiton-210 FOUND
/Users/username/Applications/Wineskin/Castles 1 and 2.app/Contents/Resources/drive_c/Program Files/Adobe/Reader 9.0/Reader/plug_ins/Multimedia/MPP/MCIMPP.mpp: Win.Trojan.Chiton-170 FOUND
/Users/username/Applications/Wineskin/Castles 1 and 2.app/Contents/Resources/drive_c/Program Files/Adobe/Reader 9.0/Reader/plug_ins3d/3difr.x3d: Win.Trojan.Chiton-213 FOUND
/Users/username/Applications/Wineskin/Castles 1 and 2.app/Contents/Resources/drive_c/Program Files/Adobe/Reader 9.0/Reader/plug_ins3d/drvSOFT.x3d: Win.Trojan.Chiton-218 FOUND
Adobe, hmm… that leads me to believe this was not actually a false positive… so what should be done? Should I simply delete the relevant files? Should I petition gog.com to take care of this? What does this particular trojan do?
I don't know if this is a false positive, or how it could occur that Castles has a trojan, so maybe someone could inform me just what may have gone on.
Only experienced users should comment, please, no baseless speculation…
Later…
Okay, so I scanned through the log file (so tedious… -- should've done a string search) and here are the relevant files:
/Users/username/Applications/Wineskin/Castles 1 and 2.app/Contents/Resources/drive_c/Program Files/Adobe/Reader 9.0/Reader/plug_ins/AcroForm/PMP/AdobePDF417.pmp: Win.Trojan.Chiton-167 FOUND
/Users/username/Applications/Wineskin/Castles 1 and 2.app/Contents/Resources/drive_c/Program Files/Adobe/Reader 9.0/Reader/plug_ins/Multimedia/MPP/Flash.mpp: Win.Trojan.Chiton-210 FOUND
/Users/username/Applications/Wineskin/Castles 1 and 2.app/Contents/Resources/drive_c/Program Files/Adobe/Reader 9.0/Reader/plug_ins/Multimedia/MPP/MCIMPP.mpp: Win.Trojan.Chiton-170 FOUND
/Users/username/Applications/Wineskin/Castles 1 and 2.app/Contents/Resources/drive_c/Program Files/Adobe/Reader 9.0/Reader/plug_ins3d/3difr.x3d: Win.Trojan.Chiton-213 FOUND
/Users/username/Applications/Wineskin/Castles 1 and 2.app/Contents/Resources/drive_c/Program Files/Adobe/Reader 9.0/Reader/plug_ins3d/drvSOFT.x3d: Win.Trojan.Chiton-218 FOUND
Adobe, hmm… that leads me to believe this was not actually a false positive… so what should be done? Should I simply delete the relevant files? Should I petition gog.com to take care of this? What does this particular trojan do?
Post edited March 03, 2014 by elus89
This question / problem has been solved by triock
