Warning--Trojan Horse

[Addled Platypus]

Right after I downloaded and installed

It has been non stop


DO NOT DOWN LOAD


THANKS FOR THE HEADACHE OF GETTING RID OF IT

[CapTVK]

I've seen these "troajn horse" alarms before. Rest assured, there isn't one. Sounds like a false positive by the virus/port scanner.

[Addled Platypus]

FYI

not when i found it using Webroot Spy Sweeper

[CapTVK]

If you really believe it's a trojan you should get in contact with some of the developers at this thread. Try to give as much details as possible:

http://forum.freeciv.org/viewtopic.php?t=976

[Addled Platypus]

will do

thanks for the link

[Per]

I tried installing webroot spy sweeper and ran it over both versions of Freeciv for windows, and got no warnings.

Can you please post the exact message you get from Webroot and where you downloaded your version of Freeciv from and which file it is?

I know there is an issue with Norton Antivirus, which stupidly suggests that any program that uses port 5555 is a Trojan. This might also be the case with Webroot, but since I could not reproduce this, they may have fixed it.

[Addled Platypus]

I agree it is probably Norton Anti Virus or Firewall.

The message was from Norton I believe, asking if I wanted to know the source. Webroot was used to remove.

I never wrote down the whole message, and It happened days ago

[frozenJim]

Um... where did you obtain your copy from?

The developers won't have much to offer if you downloaded FreeCiv from some other site than theirs.

I have FreeCiv installed on several machines and my company detects a lot of viruses on a lot of machines - but never have we found one in FreeCiv.

[bruce_dude]

Norton Anti-virus 2005

This is the warning I get from Norton AV 2005:

Rule "Default Block SERV-Me Trojan horse" stealthed (localhost,5555).
Inbound TCP connection.
Local address,service is (0.0.0.0,5555).
Remote address,service is (localhost,2278).
Process name is "D:\Program Files\Freeciv-2.0.4-gtk2\civserver.exe".

Ideas?

[bongo]

It means that norton has detected civserver.exe using port 5555. Port 5555 is freecivs standard port but also the standard port for many trojans so norton will list any app using that port as a possible threat.

You got two options:
1) Open port 5555 in your firewall
2) Make freeciv use another port.

[TheAsparagusKid]

How do you make Freeciv use a different port? I get the same error message from Norton and I don't want to open 5555.

[bongo]

Eh, don't remember how but it should be in the manuals somewhere...

Maybe you start it like this "freeciv -p:5556"?
Oh well, that was indeed a shot in the dark but I did it on an earlier version (1.3ish?) and it wasn't that hard

Had to do it because my backup software (hp ommniback) used that port...