🚀 go-pugleaf

"Baba" <spammers@pleasedie.com> wrote:

>> Maybe not. Objects detected by the Bloodhound heurisitics are normally
>> identified with "Bloodhound" in the name. Did you also pack some
>> innocent program with elitewrap and see what NAV had to say about
>> that? It may be alarming on elitewrap itself.
>
>You're right.  I packed a batch file which contained "echo hello" (pretty
>harmless, eh?) with elitewrap, and the alert window came up saying the file
>I had created was infected with "Backdoor.Trojan".
>
>I scanned the elitewrap app itself, and NAV said that no viruses were
>detected.  Strange.  I'll send elitewrap to SARC just in case it really is
>creating a trojan (but if it is, why didn't NAV detect anything in the
>elitewrap program?)

I doubt if its creating a trojan. NAV will be alarming on the
"unwrapping" code (I don't know what that program does, maybe it
compresses, encrypts, or something). There are probably one or more
known Backdoors that are processed with elitewrap.

Good idea to send it to Symantec. They'll want to be sure that they
are alarming on real trojans, not just the elitewrap code.

Bob