Mm.BOT.543B3 - Hacker Tool

[JoePesci]

First: don't panic, I don't blame anyone, it's only a question, although the thread title sounds different!

The problem I got is that my Virus Scanner keeps killing a file contained in the mm.BOT.543B3.zip called "process.exe". It says it's a "Hacker Tool".

I downloaded the bot from here: http://perso.wanadoo.fr/manus-magnus/

This is the description of the tool my scanner found:
http://www.pandasoftware.com/virus_info/encyclopedia/ficha.aspx?iddeteccion=139535

I also added a screenshot.

So i just want to be sure that this is normal, so I can prevent my virus scanner from killing that "process.exe" or switch it off or something.

 

[Nismoboi]

if i were u i would just dl it from magnus' site, someone could easily change the process.exe file with something that hacks your computer.

btw, ive scanned the mmbot from magnus' site with 3 different anti-virus nothing came up for me, all my virus definitions are up to date, all my software, so it might just be the site, magnus if u read this u should check on that site and see if they have modified your bot.

 

[ragelin]

isnt that magnus' site

 

[JoePesci]

As far as i know that IS his site!

Even if i would want it, i couldn't run the bot, only if i switch off my virus scanner so that the "process.exe" doesn't get deleted... but i dont want to switch my scanner off, unless someone more or less official says that the "process.exe" is something normal and thats it is also normal that a virus scanner finds that file and blacklists it.

Where can I download older versions... maybe my scanner lets some older versions alive?

Btw. my scanner is "Panda Platinum 2005 Internet Security". I don't know how famous this virus scanner is in the US, but here in germany most computer magazines stated that its the best or at least one of the best, so i bought this one. Maybe thats why he finds this file and others dont... hehe

 

[ragelin]

i have also scan this rar file, downloaded from his site

this is the result

Scan result from http://virusscan.jotti.org/

File: mm.BOT.543B3.zip
Status: INFECTED/MALWARE (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database)
MD5 b84950e235b1a10d2231cd55baaf1b54
Packers detected: UPX, AUTOIT
Scanner results
AntiVir Found SecurityPrivacyRisk/Processor.20
ArcaVir Found Trojan.Clicker.Small.Ht
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
Dr.Web Found Tool.Prockill
F-Prot Antivirus Found nothing
Fortinet Found nothing
Kaspersky Anti-Virus Found nothing
NOD32 Found nothing
Norman Virus Control Found nothing
UNA Found nothing
VBA32 Found nothing




And scan result from http://www.windowsecurity.com

mm.BOT.543B3\Config\System\proccess Found SecurityPrivacyRisk/Processor.20

Not sure wether this is virus anot

 

[wasup999999]

Ok, this is what is up, hacker tool means that it can be used by a hacker to do smthing (such as a md5 cracker [its a password cracker]). All it is saying is that it has the ability to send clicks or "hack" a program or whatever. This is not a virus, its doing what you want it to do. The reason why virus scanners flag HackTools is because they can be used against you if you were supposevly caught hacking something (atleast thats why I think they do it). I am 100% sure that this is not a virus or a hackertool even though they say it is.

ArcaVir Found Trojan.Clicker.Small.Ht means that it can click upon commands (your ini file)

Packers detected: UPX, AUTOIT Most scanners are now flagging AUTOIT things because their gay like that.

Dr.Web Found Tool.Prockill - Its becuase it has the code to close Diablo II when scripted to.