Hi My avg 7.5 found the trojan Vundo.t in both of my copies of notepad++ 4.2.2 anyone else had this issue or know more about it? or could tell me how to escalate this ?
the infected file is scilexer.dll file size is 168448 bytes.
cheers
sedgy
You are here
AVG 7.5 finds trojan in notepad++ 4.2.2
June 12, 2008 - 6:32am
#1
AVG 7.5 finds trojan in notepad++ 4.2.2
Visit the Community page
Join our forums
Subscribe to our email newsletter
Subscribe with RSS
Follow us on Facebook
Follow us on LinkedIn
Follow us on Twitter
Follow us on Mastodon
Follow us on BlueSky
Hi, I have the same problem.
I've sent the file to AVG as it is most likely a false positive, hopefully they can clear this up soon.
Maximilian
two versions of it as well; the dll i mentioned are different sizes and from unrelated installations (tho same version) curious how they both got hit one is 164.5 kb (portable apps 4.2.2 ) the other is 344 kb (standard install 4.2.2) what about yours?
Ditto.
AVG is flagging SciLexer.dll as being infected with trojan Vundo.T
SciLexer.dll is from PortableApps Notepad++ 4.2.2.0
WinXP is reporting that SciLexer.dll is 168,448 bytes but I'm not sure if that's accurate. I've tried copypasting and FileAlyzer but I'm being denied access to the file, probably by AVG. AVG is still in the process of scanning my computer.
other scanners say?
"What about Love?" - "Overrated. Biochemically no different than eating large quantities of chocolate." - Al Pacino in The Devils Advocate
http://virusscan.jotti.org/
Tim
Things have got to get better, they can't get worse, or can they?
I wasn't able to check what other scanners said because AVG deleted the dll instead of quarantining it. I'm not sure why it did that.
I dl'ed the new portable apps Notepad++ with a new version of SciLexer.dll. AVG scanned and passed it.
This was the first false positive I've ever had.
I got this too.
I then updated to the very latest Virus Base using the
AVG Control Center "Check for Updates" to get:
Program version AVG Free 7.5.524
Virus base 270.3.0/1500 release date 12/06/2008 16:58
After restoring the quarantined file back to the Notepad++,
I re-ran the scan on the Notepad++ directory and the SciLexer.dll
file was no longer quarantined by AVG.
As Maximilian says, probably a false positive introduced in
the previous virus base that Grisoft have already fixed.
Note that I am not an expert. Just my thoughts.
Cheers,
Andy
Hi, did an update to the database version last night to the one you are using (270.3.0/1500) mine was a day younger, and I still have the issue, the one copy i have cannot be sent anywhere
even with all the avg process turned off 
Hi, a day later I have the same problem. After AVG found and then "vaulted" the scilexer file, I rescanned my system the next morning and it found another copy in the Windows restore (System Volume Information) with, as expected, a completely different filename.
After deleting my notepad++ installation, rescanning and installing a new and updated version of notepad++ (mine was from last year don't know rev). A final reboot and scan showed no issues.
I guess I'm waiting to see if this thing is somehow rootkit'd and will reappear but I'm feeling pretty good about now.
It is unclear to me if this is (1) a false positive (2) the result of a new detection recently added to AVG that had been in notepad++ or a download of mine in the past or (3) something I opened or downloaded in the past few days. The only new files I 'executed' in the day prior to the detection were some JPGs, PDFs and Word and Excel documents from business colleagues and friends. Email scanning and resident protections detected nothing unusual at that time (though that could have just been the infection source).
Also:
- I was NOT able to examine the filesize to compare to others' notes here, sorry.
- Spybot S&D found no trouble at anytime (scan or resident).
- Zone Alarm has reported no new program attempts in or out.
I hope this helps anyone's investigation and that someone can confirm if this is or isn't a false positive from AVG.
I am happy to provide more details if needed to anyone.
--Mark.
hey guys..
i'm using AVG 8.0 free with the latest updates.
And I've installed notepad++ 4.1
AVG does also find the trojan horse vundo.t
I then reloaded the same version (notepad++ 4.1) from sourceforge.
AVG does also find the trojan in the newly loaded file.
So, there are two possibilities. There is really a trojan horse in the former versions of notepad++ or, what i believe and hope, it's a false positive.
I've send the "infected" file to avg. But there is only an automativ answer which states that the file is "infected".
What can we do now?
regards..
Everyone should read the top of this page:
https://portableapps.com/support
Cancer Survivors -- Remember the fight, celebrate the victory!
Help control the rugrat population -- have yourself spayed or neutered!
Thanks for this but this issue is also seen now in 4.1 mentioned above and I have this in both 4.22 portable and non-portable?
sedgy
I guess you didn't read or comprehend the information presented.
Cancer Survivors -- Remember the fight, celebrate the victory!
Help control the rugrat population -- have yourself spayed or neutered!
I did read it and it suggests that portable apps and the compression techniques used can create false positives.
what it does not satisfy is why the non-portable version downloaded direct from sourceforge and the portable apps version for 4.2.2 and the same for the other forum poster of 4.1 actually see this issue
As discussed earlier in the the thread for some reason I cannot get my version of scilexer.dll off my machine even with virus checkers and firewall turned off. ClamWin does not detect it