Win32:Crypt-JAC "Indiana_Jones_GameExplorerHelper.dll"

Viruses and worms
1

Can anyone tell me whether it is an false alarm? (or how I can find it out by myself) I’m not too good with computers. :'D

Avast told me about two hours ago that my computer had a trojan.
Avast says that the trojan is file called “Indiana_Jones_GameExplorerHelper.dll” which is a file for LEGO Indiana Jones game.
Virus type is “Win32:Crypt-JAC.”
Virus-identification files were updated today. (110410-0)

I tried to move the file in the quarantine, but I couldn’t since avast didn’t have rights to do so. (??)
I’m thinking about removing it if I can, but I wanted to know if somebody else had the same situation.
I have a quite strong feeling it is an false alarm again, as every “virus” on my computer has been, but you can never be too sure. ::slight_smile:

I have Avast! 4.8 Home Edition & Windows 7 Professional.

Thanks.

2

Hi ssv,

Could have been the packer led to this dll being flagged, because it also comes in a password stealer. Most instances of the software are free of malware, see: http://spywaredlls.prevx.com/RRDIID44704968/INDIANA_JONES_GAMEEXPLORERHELPER.DLL.html

The most common objects with the name of INDIANA_JONES_GAMEEXPLORERHELPER.DLL have yet to be classified as safe by our research department.
About this algorithm / compression used there see this forum, and what the author of the 11th posting there, Chrox, has to say, re: http://forum.xentax.com/viewtopic.php?f=10&t=3433&start=90 (see attached example taken from this source, given by Chrox)
Here is an exe scan of the game. I am not familiar with this algorithm / compression.
quote-source: Chrox. So best advised to upload or send the file to avast for evaluation why it shouldn't be a FP....

polonus

3

The same is happening with my “GameExplorerHelper.dll” from LEGO Batman game.

4

I sent the file to avast.

and… Just few minutes ago I got new virus definition file update and the dll is no longer recognized as a threat.

Thanks for the help. :slight_smile:

5

Hi svv,

Thanks for reporting and you have now seen how quickly these issues can be settled. So please at the end of your subject line put [SOLVED] like I did, and welcome to these here forums,

polonus