Avast! alarmed "stormupd.dll" as a trojan

system · 2007-03-26T04:19:29.000Z

Avast! alarmed “stormupd.dll” as a trojan, but to be frank it is just a file of a player~

system · 2007-03-26T04:23:57.000Z

and then if my Avast! is working I can’t run my player~ which with a mpc inside~

system · 2007-03-26T04:34:27.000Z

Hi luerdelphic,

Upload a sample of stormudp.dll to Virus Total to get a broader picture. It seems several av’s have been detecting this.

EDIT: Here’s a link

http://www.virustotal.com/en/indexf.html

system · 2007-03-26T10:18:37.000Z

Complete scanning result of “STORMUPD.DLL”, received in VirusTotal at 03.26.2007, 12:11:25 (CET).

Antivirus Version Update R esult
AhnLab-V3 2007.3.24.1 03.26.2007 Win-Trojan/Agent.32768.BI
AntiVir 7.3.1.44 03.26.2007 no virus found
Authentium 4.93.8 03.24.2007 W32/Downloader.AYSE
Avast 4.7.936.0 03.25.2007 Win32:Trojan-gen. {Other}
AVG 7.5.0.447 03.25.2007 no virus found
BitDefender 7.2 03.26.2007 Trojan.Downloader.Agent.ASG
CAT-QuickHeal 9.00 03.26.2007 no virus found
ClamAV devel-20070312 03.26.2007 no virus found
DrWeb 4.33 03.26.2007 Trojan.DownLoader.18487
eSafe 7.0.14.0 03.25.2007 Win32.Agent.beu
eTrust-Vet 30.6.3512 03.26.2007 no virus found
Ewido 4.0 03.25.2007 no virus found
FileAdvisor 1 03.26.2007 High threat detected
Fortinet 2.85.0.0 03.26.2007 W32/Agent.BEU!tr.dldr
F-Prot 4.3.1.45 03.23.2007 W32/Downloader.AYSE
F-Secure 6.70.13030.0 03.26.2007 no virus found
Ikarus T3.1.1.3 03.26.2007 Trojan-Downloader.Win32.Agent.beu
Kaspersky 4.0.2.24 03.26.2007 no virus found
McAfee 4991 03.23.2007 no virus found
Microsoft 1.2306 03.26.2007 no virus found
NOD32v2 2144 03.25.2007 no virus found
Norman 5.80.02 03.23.2007 no virus found
Panda 9.0.0.4 03.25.2007 Adware/Borlander
Prevx1 V2 03.26.2007 TROJAN.AGENT.GEN
Sophos 4.15.0 03.23.2007 no virus found
Sunbelt 2.2.907.0 03.24.2007 Trojan-Downloader.Agent.ASG
Symantec 10 03.26.2007 no virus found
TheHacker 6.1.6.080 03.23.2007 Trojan/Downloader.Agent.beu
UNA 1.83 03.16.2007 TrojanDownloader.Win32.Agent.26B9
VBA32 3.11.2 03.26.2007 Trojan-Downloader.Win32.Agent.beu
VirusBuster 4.3.7:9 03.25.2007 no virus found
Webwasher-Gateway 6.0.1 03.26.2007 no virus found

Aditional Information
File size: 32768 bytes
MD5: 053abeb4a22f570498b6257a068f863f
SHA1: edb157cb18faf1b56dd72840840ce31c8d8d4fc0
Bit9 info: http://fileadvisor.bit9.com/services/extinfo.aspx?md5=053abeb4a22f570498b6257a068f863f
Prevx info: http://fileinfo.prevx.com/fileinfo.asp?PXC=a3d671393754

DavidR · 2007-03-26T12:57:36.000Z

Well that is pretty conclusive with 16 thinking there is something wrong with it.

http://www.free-codecs.com/reviews/Storm_Codec.htm if this dll came packaged as part of a codec then depending where you downloaded the codec there is a high possibility you could get an unwelcome gift… A search for free screen savers Or free codecs are frequently high risk of getting a trojan, this seems to be a common tactic.

Since the file name stormupd.dll I think could be an update ‘upd’ process, that could be used to download things other than updates for storm codec. If that is what this relates to the storm codec, I can’t see why a codec needs an update function. These things I would have thought don’t need regular updates, like a video driver if it works you leave it alone.

It may be that because of what it can do it may have been flagged as a downloader/agent/trojan, but with this amount of detections I would seriously consider if I wanted the thing (codec or whatever) on my system.

The choice has to be yours, but you have to ask yourself, why would disabling updates (e.g. moving this file to the chest) stop a media (?) player working. You could choose to add it to the exclusions, but that isn’t something I could recommend, certainly not without much more investigation and most of the search hits are in simplified Chinese that isn’t possible for me.

system · 2007-03-27T11:12:52.000Z

How can I show my words?
I am sure that the file isnot inffected~~
It works as well before the update of my Avast! the day before yesterday~
I do think Avsat! makes much account of Chinese marketplace

what i am doing is try to make Avast! better and better~

DavidR · 2007-03-27T12:01:07.000Z

How can I show my words?

Sorry I don't understand the question.

I am sure that the file isnot inffected~~

16 AV scanners don't agree and if you check the link I gave on that it indicates that only the Chinese version that had this problem.

The Chinese version of the pack contains adware toolbar and exe while the English doesnt it. That is Why KAS detected it as trojan.
The new version of Storm Codec no longer has any adware.

So I would suggest you update your version.

As I have said the choice is yours what you do on your system, you can add it to the exclusions lists (Standard Shield, Customize, Advanced, Add and Program Settings, Exclusions) and avast won’t scan it. This I don’t recommend you should first check the other options, a different codec pack, downloading the latest storm codec version, uninstall boot and install the latest version.

VPS updates include new signatures and avast is adding more adware and spyware signatures to its database.

Lisandro · 2007-03-27T14:37:22.000Z

luerdelphic post:6:

How can I show my words?

Post a screenshot…

luerdelphic post:6:

I am sure that the file isnot inffected

Well, the online scanners have, at least, some doubt about it…

system · 2007-03-28T04:49:07.000Z

thank you so much!
I have fixed the problem out~
As the player is a fully free software so it include some ADWARE for sure~(though it is not harmful to my computer)
Sorry for that~
I changed the setting of avast! and then the software runned well

yesterday I am successed in suggest one of my friend take placed the Rising antivirus by Avast!
as the Rising is really awful~
hope software company in China can growing better and better ~ just like Avast!

DavidR · 2007-03-28T11:29:39.000Z

Your welcome, the important thing is you are aware of the issue and have chosen how to resolve it.

Announcements