Virus Issue, infected keypress.dll

[R. Ludwig]

to prevent any further downloads of an MAYBE infected/not infected
teamspeak client install package i compiled today a new client install
package and replaced it with the old.

so anyone who encountered the problem with the infected file can just
download the new client package from our main page or download
section.

hf & gl

link: ftp://teamspeak.krawall.de/releases/...t_rc2_2032.exe

edit by SatanClaus:
For a summary of this thread see this link: http://forum.teamspeak.com/show...3&postcount=76

[R. Ludwig]

*bump* *bump*

[Carolina]

Thank you!

I just did a fresh download from the main page,...it worked fine. All appears to be normal now.

I did run my anti-virus program once more before I did the download and I had turned off my Windows System Restore. I have found sometimes Virus type things for some reason stay in system restore...just sometimes.

Thank you again!

Yep Work Fine.
Thank.
Is there a problem if I put a link for this release on my TS server?

SpOnsZ.

[R. Ludwig]

Originally Posted by SpOnsZ

Yep Work Fine.
Thank.
Is there a problem if I put a link for this release on my TS server?

SpOnsZ.

thats no problem

My Norton Antivirus software after being updated scanned and found this PWS.Hooker.tojan virus inbedded in the TS software....

it called it keypress.dll

I was just wanting to know if this was Norton being paranoid or an actual virus treat inbedded in the software?

Thanks

[R. Ludwig]

Originally Posted by DMinorTrip

My Norton Antivirus software after being updated scanned and found this PWS.Hooker.tojan virus inbedded in the TS software....

it called it keypress.dll

I was just wanting to know if this was Norton being paranoid or an actual virus treat inbedded in the software?

Thanks

all looks like its a false signature file from norton/mcAFFE

but to be 100% safe we released that new package...

[VeneFicus]

I have a download dated Jan 9th 2004 that i installed countless times. After Norton AV updated it detected a "virus" Theres no doubt this is a Symantec issue and not a real virus.

Virus Alert

KEYPRESS.DLL of the TS-Software

the AV massage TR/PSW.Wexd.DLL

Antivirus (german version)
AntiVir Personal Editon 6.24.01.02 22.04.2004
Antivir Signatur 6.25.0.87 07.06.2004

Teamspeak 2 2.0.32.60

[Peter]

Heya,

please just download the TeamSpeak Client again from this homepage, and install that. The new client should not give you any problems anymore. Also, PLEASE only post if you still have problems with the new install. We already know that the old version gives problems with some anti-virus tools, so don't repost that information again and again.

Can anyone verify if TS was infected or not? I understand that downloading new version cures the problem but it seems that more then one antivirus program detects a virus/trojan in TS. This might lead to conclusion that it is not a fault of antivirus progs. Clearing all doubts is i think important for the future to prevent infection (if there was any) and for the trust of users towards TS.

[Brain]

I use antivir from www.free-av.de
Using the virus description from McAfee I've used a packet sniffer from a remote computer that surely is not infected by the virus (because it runs Debian Linux), I've searched for the files and registry entries the virus creates and I even booted a Knoppix to do the file search again in case the virus is active in memory when I boot Windows and hiding.
In all cases, I've found nothing, all I get is the virus warning from antivir so I think it is - with a chance close to certainty - just a bogus report. I don't really think it's a new variant because another virus scanner started it two weeks ago and I guess all other Antivirus businesses are jumping on the bandwagon using the same virus signature and of course producing the same false positives again.
There's no mention of a new trojan virus on securityfocus, only another full disclosure about Internet Exploder 6 arbitrary code execution... but that's nothing new

[slayer0676]

hey ludwig thanks for the new download link a lot of us really needed it. thanks a lot

Thx for the Fixed TS, I'll get the linkz out to my clan and others as well.


This Pws.Hooker.Trojan, is NOT acting as it should, do NOT fallow any removal instrustions your anti-virus gives, you might just F*ck-up your 'puter.


I read something about an infected "kern32.dll" I scanned that file too, mine was unaffected.

NOTE: My Protection is Norton 2003.

I hope this "attack" helps for future TS security issues.

[icebike]

Originally Posted by VeneFicus

I have a download dated Jan 9th 2004 that i installed countless times. After Norton AV updated it detected a "virus" Theres no doubt this is a Symantec issue and not a real virus.

Don't be so sure.
Mcaffe also found it, as did Antivir. So three of the main scanners agree there is something amiss in the keypress.dll file.

Re-download, as it (keypress.dll) has been recompiled (and it grew by 6k in the process), its now 15k instead of 9k.