Zygor Client Issues

[drmalevolent]

My java had an outdated version, but even upon getting the newer version of java and clean installing zygor client, malwarebytes anti exploit was still having a fit with it. I had to stop it entirely to install the client again.

Windows 8.1 Pro with Media Center 64bit OS
Java Version 8 Update 25
Zygor Client Version: 2.1.37

[drmalevolent]

The client is now back to it's normal self, still annoying when i shut down the client i'm notified that "An exploit code has been blocked in Java." via malwarebytes anti-exploit. Nevertheless it still opens and checks for updated guides and installs guides fine now. I don't think Defender was happy with the update file for some reason from older client versions. I added the update file to exclusions from defender so that it would update fine.

TL;DR. Remove the older client and install fresh. If using Malwarebytes Anti-Exploit Premium, you may have to temporarily halt protection for the installation then resume when finished for it not to detect an issue anymore (other than closing down zygor client entirely that it will pop up an attack attempt blocked)

I wish I had more info, unfortunately the items at my discretion and reason behind them being blocked is extremely limited...

[Zygor]

Glad to hear it's working for you again. We're still going to investigate further to see what exactly is happening.

[mab3250]

Apparantly it should be some kind of keylogger Trojan from what I have been able to dig up.

I'm sorry, I have been a Zygor customer since 2008, but there is no way I install software flagged as unsecure by two different AV programs.

While I tend to trust Zygor, I have experienced gold sellers etc. trying to get account information to steal my wow account, and I live by the motto regarding my computer - Better safe than sorry.

So I won't be updating my guides I guess until Zygor have figured out what is triggering this alert...
Just hope it's before MoD since I have already purchased that guide. And we can no longer download the guide files itself like in the old day, now we have to use the client, which I already hate. (I'm always suspicious with software that wont let me shut it down. When I press the red x in zygor client it just minimize to taskbar, and the from there I can shut it down. Why try so hard to keep the app running?? - missing a setting that let's me tell the guide to shut down when I press x)

[Zygor]

Can you link to your sources saying it's a trojan keylogger? We haven't been able to find really anything explaining what it could be. Thanks.

P.S. - You can still download the files manually like the old days. The links to do that are right below the client download buttons inside the members area.

[snipersparadise]

Today I received the same threat of a severe Trojan from Zygor guides. Trojan:Win32/Repjexi

History: Trojan

Description: This program is dangerous and executes commands from an attacker.

Recommended action: Remove this software immediately.

using Microsoft Security Essentials.. this is pretty scary stuff, this was right after I updated my Zygor Guides Client. running on Windows 7

[Zygor]

Today I received the same threat of a severe Trojan from Zygor guides. Trojan:Win32/Repjexi

History: Trojan

Description: This program is dangerous and executes commands from an attacker.

Recommended action: Remove this software immediately.

using Microsoft Security Essentials.. this is pretty scary stuff, this was right after I updated my Zygor Guides Client.

Can you provide a link directly to read what you copy/pasted there? Thanks.

[snipersparadise]

items file:C:\Users\Admin\AppData\Local\Temp\zgci.exe

I just copied it from the virus scanner itself not from any other source. but this is where it was located

they told me to goto here
http://www.microsoft.com/security/po...tid=2147685370

[Zygor]

Oh ok, yeah that's the only link we could find with any kind of information at all.

[mab3250]

Can you link to your sources saying it's a trojan keylogger? We haven't been able to find really anything explaining what it could be. Thanks.

P.S. - You can still download the files manually like the old days. The links to do that are right below the client download buttons inside the members area.

This might help - can't find the original link..
http://www.ros-bot.com/forums/bot-su...detected-15248

Thanks for the info regarding file download, haven't noticed it before - sorry

[Zygor]

We believe we've located the problem and have taken the members area down for now for maintenance, to prevent any more downloads. Should have this issue fixed shortly, will update here again when we have it fixed. Sorry about that guys.

[Zygor Dev 6]

Okay update and possible explanation.

I pushed this update last night and, for all windows users, required them to run the new one time Installer for the client.
In doing this, I had to download this installer, and since it's only a one time thing, I stored it in the temp directory, and was stupid to name it zgci.exe (short for ZygorGuidesClientInstaller.exe). The abbreviated name is likely aggravating every anti-virus under the name. I'm going to try to change this to its full, proper name and see if it stops the false triggers.


Rest assured, there is no trojan. No one seems to have been breached and no malicious files seem to have been uploaded to the server.

[mzanker]

Just tried running the client. It says it's downloading the client update, then the window closes and nothing happens after that. Looking in Task Manager there appears to be no java apps or run-time running. If I run the client again, it just downloads the update again, then does nothing.

[Zygor Dev 6]

Looking into this. I don't have this issue but others are saying they do.

[snipersparadise]

The awesome Zygor staff should have a fix out soon.