My Symantec just found this:
Is it ok? is it just a false positive?!?
[email protected] said:
My Symantec just found this:
Is it ok? is it just a false positive?!?
Click to expand...
Click to collapse
I use Kaspersky Internet Security 2010, never had a notification about a trojan in the visualkitchen.
So must be a false positive...
gr
i'm on norton and i update my v-def every week.. i don't seem to experience this either.. was it infected somehow when d/led onto your pc?
SiRIus[X] said:
i'm on norton and i update my v-def every week.. i don't seem to experience this either.. was it infected somehow when d/led onto your pc?
Click to expand...
Click to collapse
this is a false warning.
also once this happens the vk will not work properly.
shut of ur ol protection for the time ur using vk n restore any file it ha repaired or qurantined
I've just had Nod32 quarantine the download due to a trojan too.
Related
Hi, can someone here send me the OEM_FLASHDRV.dll file from their Trinity so I can patch it to do what's stated in the topic title, cheers.
Patcher complete; download here.
File now signed, redownload
manual DLL included now
If you tell my how I'll gladly do it. I get access denied when I try to copy it via Vista explorer.
ZakMcRofl said:
If you tell my how I'll gladly do it. I get access denied when I try to copy it via Vista explorer.
Click to expand...
Click to collapse
get it from a ROM dump of an OS image on your computer, not from the PDA
Olipro said:
get it from a ROM dump of an OS image on your computer, not from the PDA
Click to expand...
Click to collapse
There it is....
It is from RUU_Trinity_DOPODASIA_WWE_1.23.707.6_6275_1.35.00.11_108_Ship.exe
ok, it's done, enjoy
Thanks. Although being the noob that I am right now I don't exactly know how this will help me
I saved a copy in case I need to edit the ExtROM someday.
Sorry, I can't find any change after patch , please help, I realy want to put some software in the ext_rom.
eddietse said:
Sorry, I can't find any change after patch , please help, I realy want to put some software in the ext_rom.
Click to expand...
Click to collapse
you still have to unhide the ExtROM manually, and sadly, I haven't quite worked out certificate deployment, so you need to use Security Configuration Manager to drop the developer certificates onto your device.
Olipro said:
you still have to unhide the ExtROM manually, and sadly, I haven't quite worked out certificate deployment, so you need to use Security Configuration Manager to drop the developer certificates onto your device.
Click to expand...
Click to collapse
I've unhide my Trinity. But after I run the patch, I can't see my extrom anymore. I can't unhide it again...
ok, sorry guys, I forgot to sign the dll... I'll do it later.
you STILL have to put the developer certificates on the device yourself though.
Olipro said:
ok, sorry guys, I forgot to sign the dll... I'll do it later.
you STILL have to put the developer certificates on the device yourself though.
Click to expand...
Click to collapse
So Olipro have you signed the .dll??
yes, I've recently been indulging in the consumption of booze down the local pub, so sorry for the delay; it's done now.
Remember that you still need to provision the developer certificates onto your device yourself.
I'm afraid that the Security Configuration Manager still finds the app "Unsigned".
Any further help would be appreciated.
sammis said:
I'm afraid that the Security Configuration Manager still finds the app "Unsigned".
Any further help would be appreciated.
Click to expand...
Click to collapse
the application is unsigned... the dll that gets put on your phone by the app however is not.
Olipro said:
the application is unsigned... the dll that gets put on your phone by the app however is not.
Click to expand...
Click to collapse
I'm afraid that i may be a bit on the slow side but i can't make heads or tails out of this process,i've read the Hermes posts and still nothing .
If you find the time please post a step by step guide as to how the app can be signed with a privileged certificate as that seems to be the problem.
sammis said:
I'm afraid that i may be a bit on the slow side but i can't make heads or tails out of this process,i've read the Hermes posts and still nothing .
If you find the time please post a step by step guide as to how the app can be signed with a privileged certificate as that seems to be the problem.
Click to expand...
Click to collapse
no... it's not.
the application just needs to be executed on your device, the DLL that is placed on the device needs to be signed... which I have done.
specifically, it's OEM_FLASHDRV.dll that I signed, and no, you can't view it till it's on your Trinity.
Let me tell you what i did,i ran the Security Configuration Manager, changed the configuration from locked to Security Off then pressed Provision.unhid the EXROM using Hermes_MountALLExTrom,transfered the patch to the PPC and ran it .
I got the message Extrom Patched Resetting..,i reset the device but alas no extrom.
sammis said:
Let me tell you what i did,i ran the Security Configuration Manager, changed the configuration from locked to Security Off then pressed Provision.unhid the EXROM using Hermes_MountALLExTrom,transfered the patch to the PPC and ran it .
I got the message Extrom Patched Resetting..,i reset the device but alas no extrom.
Click to expand...
Click to collapse
yeah... you need to go to the Device menu to install the developer certificates.
The only things in the "file" menu are, Save connected Device Configuration,Sign File and Check File Signature.
my mistake; the Device menu.
really... couldn't people have the intelligence to actually bother looking for it.
people on this forum have now successfully exceeded the level of stupidity I've experienced on the Hermes section.
Earlier I started a thread about being unable to sync.
But I don't think that is the problem, I just realised that I can no longer copy, move or delete files from either the PDA or the MC, I get an "access is denied, insufficient memory, make sure file is not set as read only or I don't have the permissions?
If I put my memory card in a reader it's OK.
Does anyone have any idea what the problem might be?
Thanks
Heloooo.....
Have you tried a soft reset of the PDA?
colinm said:
Have you tried a soft reset of the PDA?
Click to expand...
Click to collapse
Hi Colin, yeah tried that but no difference.
hey bro this is not ur pda problem thats ur Mac problem.. its virus infected.. on windows its says..access denied.. or administrator disabled the rights..i had the same problem on windows...try on another PC or Mac..i am sure it will work..
malhaar said:
hey bro this is not ur pda problem thats ur Mac problem.. its virus infected.. on windows its says..access denied.. or administrator disabled the rights..i had the same problem on windows...try on another PC or Mac..i am sure it will work..
Click to expand...
Click to collapse
? Greetings, WTF are you on....
Free Sport and Exercise Tracker and Pace Calculator from Handango.com
it is free and i downloaded it and it is a .exe file and only 56kb
when i run it on the comp it says "Windows CE services not found on this computer. Setup cannot continue and will now exit" i just got this comp like 3 weeks ago (hp dv2842se) but thats another story
i put it on my storage card on my tilt and it wont work at all it says " 'sportimertrialsetup22.exe' is not a valid Pocket PC application."
so i dont get it
here is the app
http://www.handango.com/PlatformProductDetail.jsp?productId=142977
can any help me get this working on my tilt?
alph0e said:
Free Sport and Exercise Tracker and Pace Calculator from Handango.com
it is free and i downloaded it and it is a .exe file and only 56kb
when i run it on the comp it says "Windows CE services not found on this computer. Setup cannot continue and will now exit" i just got this comp like 3 weeks ago (hp dv2842se) but thats another story
i put it on my storage card on my tilt and it wont work at all it says " 'sportimertrialsetup22.exe' is not a valid Pocket PC application."
so i dont get it
here is the app
http://www.handango.com/PlatformProductDetail.jsp?productId=142977
can any help me get this working on my tilt?
Click to expand...
Click to collapse
I think you need to set up ActiveSync Connection And Run the EXE on your Computer and then it will place and install the Cab on your device.
JimmyMcGee said:
I think you need to set up ActiveSync Connection And Run the EXE on your Computer and then it will place and install the Cab on your device.
Click to expand...
Click to collapse
wow didnt even think about that good idea imma let you know how it goes
thats not a good idea,
thats gone work for sure..
denjo said:
thats not a good idea,
thats gone work for sure..
Click to expand...
Click to collapse
Activesync caot be installed on a vista computer
SO NOW WHAT?
alph0e said:
Activesync caot be installed on a vista computer
SO NOW WHAT?
Click to expand...
Click to collapse
Active sync 4.5 does not work with Vista, you need to install Windows Mobile Device Center.
it wont work i used the cd and it wont install
google it
try searching google for windows mobile device centre
Maybe get a Mac.
alph0e said:
Activesync caot be installed on a vista computer
SO NOW WHAT?
Click to expand...
Click to collapse
First Step, Get a Real Operating System.
As soon as I can get OpenSync Working on my ubuntu Drake Set up I will no longer need XP
But try downloading Device Center From the Site. I had the same problem where it wouldn't install from the CD either on my old Vista Machine. But when I downloaded it from the website it installed a'ok.
Device Center
I ran across the same issue when I upgraded to Vista. I had to also go download the program necessary for installing anything to my device:
http://www.microsoft.com/windowsmobile/en-us/downloads/microsoft/device-center.mspx
Basically install it, then connect your device to the PC and install like normal. When your done make sure to check your program folder to make sure it is in there.
If it was Handango you got this through, they are usually pretty good at helping with this sort of thing. So if my suggestion doesn't work for you they might help.
Is there anything like a file manager to have better controll where files are located. Anyway to pen the folders provided by the SamsngATIV-S
At this time no.
There is none which doesn't make sense to me because I can plug in my Lumina 822 to my PC and see my files that way. :silly:
sinister1 said:
There is none which doesn't make sense to me because I can plug in my Lumina 822 to my PC and see my files that way. :silly:
Click to expand...
Click to collapse
Actually it does make sense since you don't always have your pc around
Taurenking said:
Actually it does make sense since you don't always have your pc around
Click to expand...
Click to collapse
Actually thats what i was trying to say LOL. In other words you can do it by pluging your phone up to the PC, why not give us the opption to do so on the phone it's self.
sinister1 said:
There is none which doesn't make sense to me because I can plug in my Lumina 822 to my PC and see my files that way. :silly:
Click to expand...
Click to collapse
You cannot see the OS files this way, I want to see the files of the OS (WP8) to make changes as I want ti have it
[email protected] said:
You cannot see the OS files this way, I want to see the files of the OS (WP8) to make changes as I want ti have it
Click to expand...
Click to collapse
WP8 does not allow any OS file access at all.
WP8 + Surface Pro = File explorer anywhere. Seems legit.
Hi all,
A while ago I managed to install LightJB thanks to this forum; the phone became a lot snappier because that ROM had ditched a bunch of bloatware.
Just now, I ran a PC system scan with Ad-Aware which detects in the file "LightJBv1-2.zip", a trojan called "SMSspy". The ROM is too big to upload, but its size is reportedly 417 MB (437.476.670 bytes), and the size on disk is 417 MB (437.477.376 bytes). Unfortunately I have not written down from what mirror I downloaded the ZIP file, but it was a link listed here as I slavishly followed all suggested steps. I did a search for 'virus' and for 'LightJBv1-2' and did not find any report on this. This leads me to believe that more people have downloaded the file. Possibly the ROM has been used as a basis for other ROMs (I am quite a n00b, so perhaps this is a dumb remark:cyclops.
I was wondering whether this might be a false positive, or perhaps if someone that has the LightJB v1-2 installation file on his/her PC could try to verify if the Ad-Aware scan was correct or not?
I am using some government services that require an SMS verification system, which makes me worry a bit..
Kind regards and please do let me know if more info is required,
Wouter
wouterwp said:
Hi all,
A while ago I managed to install LightJB thanks to this forum; the phone became a lot snappier because that ROM had ditched a bunch of bloatware.
Just now, I ran a PC system scan with Ad-Aware which detects in the file "LightJBv1-2.zip", a trojan called "SMSspy". The ROM is too big to upload, but its size is reportedly 417 MB (437.476.670 bytes), and the size on disk is 417 MB (437.477.376 bytes). Unfortunately I have not written down from what mirror I downloaded the ZIP file, but it was a link listed here as I slavishly followed all suggested steps. I did a search for 'virus' and for 'LightJBv1-2' and did not find any report on this. This leads me to believe that more people have downloaded the file. Possibly the ROM has been used as a basis for other ROMs (I am quite a n00b, so perhaps this is a dumb remark:cyclops.
I was wondering whether this might be a false positive, or perhaps if someone that has the LightJB v1-2 installation file on his/her PC could try to verify if the Ad-Aware scan was correct or not?
I am using some government services that require an SMS verification system, which makes me worry a bit..
Kind regards and please do let me know if more info is required,
Wouter
Click to expand...
Click to collapse
Whats the file name which antivirus find it as virus?
Force said:
Whats the file name which antivirus find it as virus?
Click to expand...
Click to collapse
thanks for the reply. I have made a screendump to prove my point about the ZIP (attached). I then unpacked and scanned the contents hoping Ad-aware would pinpoint the file containing the SMSspy.GD trojan. However, it did not find anything Does this mean it is a false positive? I don't know, but Ad-aware does continue to find this Trojan in the ZIP file...
F-Secure has written about the SMSspy trojan and what the code does. Unfortunately I'm not allowed to post a link there, but searching Duckduckgo with this "On Android threats Spyware:Android/SndApps.A and Trojan:Android/SmsSpy.D." does bring up the site immediately. I'm reckoning someone could change some values in that code to make a phone running the hacked app send data to himself. Perhaps someone on this forum recognizes where this code may be put and help with this search. Anyone with the F-secure virusscanner could also download the LightJBv1-2.ZIP file and go through the contents.
I have scanned several more times since then and no suspicious file was found... I downloaded the Avira scanner hoping that it would find SMSspy.GD too, but to no avail. Avira does find code of Rootor.RH (listed as a virus in their database) in the Superuser.apk files, but I'm guessing that is a false alarm that has to do with the function of the Superuser app.
wouterwp said:
thanks for the reply. I have made a screendump to prove my point about the ZIP (attached). I then unpacked and scanned the contents hoping Ad-aware would pinpoint the file containing the SMSspy.GD trojan. However, it did not find anything Does this mean it is a false positive? I don't know, but Ad-aware does continue to find this Trojan in the ZIP file...
F-Secure has written about the SMSspy trojan and what the code does. Unfortunately I'm not allowed to post a link there, but searching Duckduckgo with this "On Android threats Spyware:Android/SndApps.A and Trojan:Android/SmsSpy.D." does bring up the site immediately. I'm reckoning someone could change some values in that code to make a phone running the hacked app send data to himself. Perhaps someone on this forum recognizes where this code may be put and help with this search. Anyone with the F-secure virusscanner could also download the LightJBv1-2.ZIP file and go through the contents.
I have scanned several more times since then and no suspicious file was found... I downloaded the Avira scanner hoping that it would find SMSspy.GD too, but to no avail. Avira does find code of Rootor.RH (listed as a virus in their database) in the Superuser.apk files, but I'm guessing that is a false alarm that has to do with the function of the Superuser app.
Click to expand...
Click to collapse
My antivirus ( G Data antivirus) find in harshjelly rom a virus too in MobileTrackerEngineTwo.apk and at description was writing something like Android.Riskware.sms... I scaned with same antivirus same apk from system folder from stock jb firmware and it doesnt find any virus. So i dont know what to think or what to say...
Force said:
My antivirus ( G Data antivirus) find in harshjelly rom a virus too in MobileTrackerEngineTwo.apk and at description was writing something like Android.Riskware.sms... I scaned with same antivirus same apk from system folder from stock jb firmware and it doesnt find any virus. So i dont know what to think or what to say...
Click to expand...
Click to collapse
I have it!! That is, Avira did find it this time:
--> system/app/DSMLawmo.apk
[5] Archieftype: ZIP
--> classes.dex
[DETECTIE] Bevat code van het virus ANDROID/SmsSpy.S.Gen
Click to expand...
Click to collapse
(Dutch version, reporting "[DETECTION] Contains code of the virus ANDROID/Smsspy.S.Gen")
Apparently, the classes.dex file in the DSMLawmo.apk contains the Trojan code. What does this file do and who can open the APK file and check whether the code from the SMSSpy trojan (see my previous post about the F-secure forum message) is actually being misused??
best regards, Wouter
Attached:
- screendump showing Avira found the virus in the DSMLawmo.apk file,
- the Avira log (also finding code of another virus in Superuser.APK - I am guessing this has to do with the fact that Superuser is root-related and therefore scares the virusscanner),
- and.. the infected APK file. I renamed this file to make sure people don't run it unintentionally. SO please, only run the APK if you know what you're doing! I take no responsibility for any damages coming from running it (as a matter of fact, I might be a victim myself as I installed and am still running JBLightV1-2 on my Samsung Advance S). I do think the importance of uploading this file outweighs the risks as developers may have unwillingly and unknowingly contributed to spreading malicious code through this great community. It may - after all - also be a false positive, but two scanners have now found the SMSSpy trojan independently.
Please tell me how to remove G data Internet security ? When I try to remove from Goole Play, tell me to the this application is Administrator on device, and I must deactivate first , and try remove ?
How to deactivate???
Try in Settings --> Security (on CM11, on Stock look for something similar)
Wysłane z mojego GT-I9070 przy użyciu Tapatalka
XDADev Forum i9300 ROMs contain trojans
Just bumping this post as it appeared on google when I looked up the smsspy.s.gen virus. The Avira database had this to say:
The file is a malicious Android application that undermines the security of the device or the privacy of the user. Typically, Android malware attempts to steal personal or account information, gain access to device functions via backdoors, send text messages or dial premium numbers, and lock or encrypt the device so the user must pay to unlock the device.
Operating System: Android.
This piece of malware is able to steal sensitive information.
Aliases
AVG: Android/G2M.R.FB4923BB003A
Avast: Android:SmsSpy-KB
Dr. Web: Android.SmsBot.439.origin
ESET: Android/TrojanSMS.Agent.AAJ trojan
Kaspersky Lab: HEUR:Trojan-Spy.AndroidOS.SmsThief.es
So in general, this isn't some harmless adware and what is more disturbing is that my anti-virus didn't detect the trojan when I downloaded the I9300XXUGNH4.LiteROM zip file. The trojan also appears to remain dormant for several weeks before activating. It's damage isn't limited to Android since it was hijacking Java files on my PC and dropping a Bladabindi backdoor virus into them. I also found that another APK file called DSMLawmo contains the same virus. So in short, the xdadeveloper forum is a minefield of trojan software which the administrators really need to do something about since it undermines the trust of it's users.