Texmod and wtf*.tmp trojan horse - Page 2 - Guild Wars Forums

Kumu Honua · Jul 17, 2008, 07:58 AM // 07:58

If you read above you notice someone posts a screenshot showing that Avira is also giving false positives (As well as not even having the entry in their searchable database).

BabyJ · Jul 17, 2008, 01:07 PM // 13:07

Yes, I use avira. Whats really strange is today I can load texmod fine without alerts. I did although, go through my comp and cleaned up all the cookies and temp files and junk. My guess is there was a temp file left which was causing the false positives.

beserk · Jul 17, 2008, 01:14 PM // 13:14

I use textmod all the time NEVER had a problem except those annoying patterns that occasionally show up on the screen whilst playing...but i just minimize/maximize the screen and it goes XD.

Snograt · Jul 17, 2008, 01:32 PM // 13:32

Variations of the Lineage keylogger/trojan are known false-positives with some AV products. I've had one myself, which scared the hell out of me - but it was false.

Targren · Jul 17, 2008, 01:43 PM // 13:43

Quote:

Originally Posted by fenix

Get Avira for free or pay for NOD32 imo

Worst...advice...ever... You call AVG bad and then recommend people get NOD? Wow. AVG isn't good, admittedly, but that's a half-step above telling them to get Norton Invade-Every-Subsystem^W^W^WInternet Security.

Fril Estelin · Jul 17, 2008, 01:51 PM // 13:51

Quote:

Originally Posted by Targren

Worst...advice...ever... You call AVG bad and then recommend people get NOD? Wow. AVG isn't good, admittedly, but that's a half-step above telling them to get Norton Invade-Every-Subsystem^W^W^WInternet Security.

NOD32 has nothing to do with Norton, it's one of the best AV out there (with Kaspersky). Antivir is slightly better than AVG.

Targren · Jul 17, 2008, 01:59 PM // 13:59

Quote:

Originally Posted by Fril Estelin

NOD32 has nothing to do with Norton, it's one of the best AV out there (with Kaspersky). Antivir is slightly better than AVG.

I know it's got nothing to do with norton. It's from some Slovak company. ESET I think. I said it's a "half-step better than". It might be really good at finding viruses, but it's a complete killer on performance.

DarkNecrid · Jul 17, 2008, 02:09 PM // 14:09

Maybe if you have a bad PC or something? I have it running at all times and run GW at 120 fps un-v-synched. (just checked)

Snograt · Jul 17, 2008, 02:34 PM // 14:34

ESET NOD32 - AV of choice for the discerning consumer. Excellent detection and removal rate and extremely small footprint. It's about the best there is for not affecting PC performance.

Sol Faithman · Oct 24, 2008, 06:09 PM // 18:09

Looks like Norton have decided that texmod is bad

I've been using texmod on 3 pc's for ages and run up to date Norton, Spybot and a number of other anti spyware packages and not 1 single one has ever come back with texmod as being a trojan.

Updated 2 pc's to Norton 2009 the other day and boom, texmod is detected as a trojan and is deleted. Just switched the 3rd pc on for the first time in a week and update the virus definitions etc (still running Norton 2008) and guess what, trojan detected and it texmod gets deleted!!

Now I know for sure that this version was acquired from the official wiki pages when it first came out (when the skinning fade first started) so I can categorically say its not a new download, and it was checked then and has been checked numerous times through virus scans etc, so why all of a sudden is it classed as a virus?

I'm off to follow the link above to the "official" version and see if Norton picks that up as a trojan.

Cheers

Rich

Kale Ironfist · Oct 24, 2008, 10:25 PM // 22:25

It's classified as a trojan, as it hijacks another program. If you can, place it on the ignore list. Otherwise, either ignore it or get a better program.

fenix · Oct 25, 2008, 12:16 AM // 00:16

It's just a false positive. A GOOD anti-virus won't bring up an error because it's not actually a trojan. Ignore Kale Ironfist, there's no reason to block the file.

Just noticed I had posted here before, hah.

Quote:

Worst...advice...ever... You call AVG bad and then recommend people get NOD? Wow. AVG isn't good, admittedly, but that's a half-step above telling them to get Norton Invade-Every-Subsystem^W^W^WInternet Security.

Not really. AVG IS bad, and NOD32 is the best you can get. Nice work getting NOD32 and Norton mixed up, moran. Also, NOD32 is the best Anti Virus not only because of the detection rate, but because it uses almost no RAM, AND is 5x faster at scanning than all the others.

So uh...why is it the worst advice ever?

DarkNecrid · Oct 25, 2008, 01:47 AM // 01:47

I can't believe someone said NOD32 is bad. I think I've seen everything now.

To OP:
If you got it off the link on the Wiki, it's safe. TexMod not only hijacks another program, it intercepts your DirectX calls and redirects them to display alternate textures (basically). All bad AV's will report this as a made up trojan because it's a false positive. (These AV's display anything that hijacks another program as a false pos.)

Kale Ironfist · Oct 25, 2008, 03:04 AM // 03:04

Quote:

Originally Posted by fenix

It's just a false positive. A GOOD anti-virus won't bring up an error because it's not actually a trojan. Ignore Kale Ironfist, there's no reason to block the file.

1. Yes, it does hijack the program (how else does it insert the image you want to see?)
1a. Corollary to that, it doesn't harm the computer in any way. Nortons' algorithm apparently doesn't care though.
2. I didn't say to block Texmod, I said to place it on the anti-virus' ignore list. If that wasn't possible, either learn to put up with it, or get a better anti-virus software.

While the context wasn't clear, there is no better version of texmod, so I'm confused as to how you misinterpreted my words so badly.

Zebideedee · Oct 25, 2008, 01:07 PM // 13:07

I got the same reports and asked about on here, I think if you get from Wiki all should be safe. Although after I got cartographer title, I deleted the prog etc. scanned my whole comp and changed my password on GW's, maybe a bit extreme but as the saying goes, 'Better safe than Sorry'

bob12332 · Apr 29, 2009, 09:13 AM // 09:13

About this Trojan
Detected: PWS-Mmorpg.gen (Trojan), PWS-Mmorpg.gen (Trojan)

The Ossus Keeper · Apr 29, 2009, 07:52 PM // 19:52

My McAfee virus scan detected the same thing...
Imo, I think texod should be re-written so that it is more PC friendly and so that virus scanners don't pick up this So-Called False Positive!
Personally i don't trust texmod when my virus scanner says it contains a password stealling trojan, or anything else for that matter.
Re-write texmod, make it more pc/scanner friendly... problem sloved!

Jul 17, 2008, 01:32 PM // 13:32	#24
Snograt rattus rattus Join Date: Jan 2006 Location: London, UK GMT??0 ??1hr DST Guild: [GURU]GW [wiki]GW2 Profession: R/	Variations of the Lineage keylogger/trojan are known false-positives with some AV products. I've had one myself, which scared the hell out of me - but it was false. __________________ Si non confectus, non reficiat

Jul 17, 2008, 02:34 PM // 14:34	#29
Snograt rattus rattus Join Date: Jan 2006 Location: London, UK GMT??0 ??1hr DST Guild: [GURU]GW [wiki]GW2 Profession: R/	ESET NOD32 - AV of choice for the discerning consumer. Excellent detection and removal rate and extremely small footprint. It's about the best there is for not affecting PC performance. __________________ Si non confectus, non reficiat

Apr 29, 2009, 09:13 AM // 09:13	#36
bob12332 Pre-Searing Cadet Join Date: Apr 2009 Guild: aba Profession: A/N	Trojan Horse TexMod About this Trojan Detected: PWS-Mmorpg.gen (Trojan), PWS-Mmorpg.gen (Trojan)

Jul 17, 2008, 07:58 AM // 07:58	#21
Kumu Honua Jungle Guide Join Date: Feb 2008	If you read above you notice someone posts a screenshot showing that Avira is also giving false positives (As well as not even having the entry in their searchable database).

Jul 17, 2008, 01:07 PM // 13:07	#22
BabyJ Frost Gate Guardian Join Date: Jul 2006 Location: Illinois Guild: SFG Profession: Mo/	Yes, I use avira. Whats really strange is today I can load texmod fine without alerts. I did although, go through my comp and cleaned up all the cookies and temp files and junk. My guess is there was a temp file left which was causing the false positives.

Jul 17, 2008, 01:14 PM // 13:14	#23
beserk Krytan Explorer Join Date: May 2008 Location: UK Profession: W/	I use textmod all the time NEVER had a problem except those annoying patterns that occasionally show up on the screen whilst playing...but i just minimize/maximize the screen and it goes XD.

Jul 17, 2008, 02:09 PM // 14:09	#28
DarkNecrid Furnace Stoker Join Date: Jul 2006	Maybe if you have a bad PC or something? I have it running at all times and run GW at 120 fps un-v-synched. (just checked)

Oct 24, 2008, 06:09 PM // 18:09	#30
Sol Faithman Frost Gate Guardian Join Date: Aug 2005 Guild: WOLF Profession: W/Mo	Looks like Norton have decided that texmod is bad I've been using texmod on 3 pc's for ages and run up to date Norton, Spybot and a number of other anti spyware packages and not 1 single one has ever come back with texmod as being a trojan. Updated 2 pc's to Norton 2009 the other day and boom, texmod is detected as a trojan and is deleted. Just switched the 3rd pc on for the first time in a week and update the virus definitions etc (still running Norton 2008) and guess what, trojan detected and it texmod gets deleted!! Now I know for sure that this version was acquired from the official wiki pages when it first came out (when the skinning fade first started) so I can categorically say its not a new download, and it was checked then and has been checked numerous times through virus scans etc, so why all of a sudden is it classed as a virus? I'm off to follow the link above to the "official" version and see if Norton picks that up as a trojan. Cheers Rich

Oct 24, 2008, 10:25 PM // 22:25	#31
Kale Ironfist Jungle Guide Join Date: Jul 2006 Location: Australia Guild: Venatio Illuminata [VEIL] Profession: W/	It's classified as a trojan, as it hijacks another program. If you can, place it on the ignore list. Otherwise, either ignore it or get a better program.

Oct 25, 2008, 01:47 AM // 01:47	#33
DarkNecrid Furnace Stoker Join Date: Jul 2006	I can't believe someone said NOD32 is bad. I think I've seen everything now. To OP: If you got it off the link on the Wiki, it's safe. TexMod not only hijacks another program, it intercepts your DirectX calls and redirects them to display alternate textures (basically). All bad AV's will report this as a made up trojan because it's a false positive. (These AV's display anything that hijacks another program as a false pos.)

Oct 25, 2008, 01:07 PM // 13:07	#35
Zebideedee Jungle Guide Join Date: Sep 2007 Location: 55?? 57' 0" N / 3?? 12' 0" W Profession: N/Me	I got the same reports and asked about on here, I think if you get from Wiki all should be safe. Although after I got cartographer title, I deleted the prog etc. scanned my whole comp and changed my password on GW's, maybe a bit extreme but as the saying goes, 'Better safe than Sorry'

Apr 29, 2009, 07:52 PM // 19:52	#37
The Ossus Keeper Ascalonian Squire Join Date: Apr 2007 Guild: [RotG] Profession: R/Mo	My McAfee virus scan detected the same thing... Imo, I think texod should be re-written so that it is more PC friendly and so that virus scanners don't pick up this So-Called False Positive! Personally i don't trust texmod when my virus scanner says it contains a password stealling trojan, or anything else for that matter. Re-write texmod, make it more pc/scanner friendly... problem sloved!