Flibbertygibbets

Join Date 04/2002

Virus from Windowsblind

I just went to download JJ Ying's submission V!VA for Windowblinds and my AV software popped up to warn me that I had recieved W32/HLLP.Philis.ini virus along with the download. It's a low risk virus but that's beside the point. Are these submissions scanned before they are posted? I've never gotten anything from a WB before. Is this possibly a mis-identification?

Locked Post

Advanced Search

Watch this post

Do not email me updates for this post Email me updates for this post

Successfully updated karma reason!

Zoomba

Join Date 11/2002

+114

What AV Software are you running? Right now, it looks to be something that only McAfee is catching.

Successfully updated karma reason!

Zoomba

Join Date 11/2002

+114

The virus warning people seem to be getting on this skin appears to only show up under the McAfee scan. Kaspersky, Computer Associates and NOD32 so far have all cleared the skin as clean.

Until we get this confirmed by a second virus scan tool, we're going to assume that it's an anomaly with McAfee and let it stand.

Successfully updated karma reason!

Ran an individual scan with AVG for EVERY file within this blind, and turned up nothing...

Also ran an online scan ...again nothing.

JJYing would be extremely careful about things like this.

Successfully updated karma reason!

Sign Up or Login and this ad disappears!
There are many great features available to you once you register. Sign Up for a free account and browse the forums without ads.

Yes, I'm running McAfee and it could be a McAfee quirk but it did find and delete the file on a full sweep. It could also be like running adware programs, one program doesn't see anything but the next one will. They only see bugs that they have the definitions for.

P.S. "if" there is a virus in the file I don't think that JJYing would have known about it. People with that kind of skill tend to be very conscientious.

Successfully updated karma reason!

JJ-Ying

Join Date 08/2003

+48

I only have kapa installed, maybe I need to use another av soft to check them and ensure they are not infacted

Successfully updated karma reason!

try mcafee

Successfully updated karma reason!

Skinhit

Join Date 11/2004

+516

when i downloaded Ares by Mike B from here, it shut down my antivirus, shut down Firefox and then froze my computer. I use Comp.Assoc.AV. Upon restart everything worked fine?

Successfully updated karma reason!

I use McAfee and I got the warning, too.

There's a file called "_desktop.ini" within the wba file. The W32/HLLP.Philis virus creates "_desktop.ini" in every folder while looking for executable files to infect.

From what I understand, "_desktop.ini" is not a virus itself and poses no threat - it's a file left behind by the virus, which may be why most anti-virus programs aren't catching it. In any case, anyone who installed the blind should probably delete "_desktop.ini" from the WindowBlinds\V!VA directory if it's there.

ZOOMBA - If you delete "_desktop.ini" from the wba file (which is what McAfee does when it finds it), users won't get the virus warning after they download it.

By the way ... the blind looks great!

Successfully updated karma reason!