Zygor Client Issues

[ZG Support 1]

We're just happy it was something like this and not actually a virus that slipped into our code. The last thing we want is to have malicious code make it to our customers who have come to trust us for having a quality product.

[Zygor Dev 6]

If any further issues with virus detection pop up, don't hesitate to let us know.

[Ingeke]

I wanted to start Zygorguides Client today and Avast stopped it and removed it announcing that it contains a virus called Win32-Evo-gen.
I removed everything what was left from Zygorguides and tried to download the client again, but Avast didn't let me do it and promptly deleted the download link again announcing it has a virus called the same name as I mentionned above.

I include a picture of it and the first line you see is when I wanted to download it and the others were when I wanted to open the file first.

ZygorGuides.jpg

[ZG Support 1]

Please make sure you have all Windows updates applied to your system, any Java updates applied, and that you have the latest version of Avast and the virus definition files. This is a false positive.

[Ingeke]

Please make sure you have all Windows updates applied to your system, any Java updates applied, and that you have the latest version of Avast and the virus definition files. This is a false positive.

I always keep everything updated, so that is not the issue.

So, I can take it that it is save and the client doesn't contain a virus ?

[Cartman]

Appartently currently nothing is wrong with the Zygor files.
Here are the VirusTotal results.
Installer, filesize 1.274.874 Bytes: https://www.virustotal.com/de/file/8...235a/analysis/
Client, fielsize 1.849.997 Bytes: https://www.virustotal.com/de/file/0...is/1415179892/

From my experience most of the virus warnings about something that contains a -gen are false positives. This means the antivirus software found something with a similar signature as a virus or often "only" something suspicious.
For example the good old cheat or trainer programs for games are normally flagged as some generic keylogger because they run in the background waiting to be activated by pressing for example the function keys while running the game.

But still, if you are unsure about something it is a good idea to be cautious.

[ZG Support 1]

As Cartman says, to the best of our knowledge this is just a false positive and all scans we have run on our own computers using ESET and Kaspersky anti-virus software packages have come up clean. In addition when we test the files with the VirusTotal website they come up clean there.

If you're still unsure about the safety of the files we always have zip files available right below the Download buttons in the Members Area that you can use to do a manual installation of the guide files, avoiding the executable files that are being flagged by your anti-virus. These zip files contain files that can be opened with any text editor and the LUA code in the files are only accessed from within WoW which limits all functions to just the WoW game.

[Msdawg1]

I found this thread because tonight I tried installing the version of the latest client currently posted, and Panda Antivirus identified it as containing a virus and Quarantined it to neutralize:Untitled.png.

[ZG Support 1]

I just downloaded a fresh copy (what you would have just downloaded) and ran it thru VirusTotal again so there would be multiple anti-virus software looking at it. It came up clean so it would seem you are receiving a false positive from Panda.
https://www.virustotal.com/en/file/8...is/1415579486/

[Cartman]

"Exploit.gen" is a very vague description of what Panda has found suspicious.
I think it's possible that the function to automatically download and run the client executable is something an antivirus program may stumble across.
The older Java versions of the Zygor client only used the jar file and no exe file, maybe that's the reason why this problem comes up now.