CoPilot Central 7 Malware Found

[Smilodon]

When I installed CoPilot Central 7 (U.S. Version) on my Windows XP machine (which I had just uninstalled the previous version on), the install seemed to go ok.

I ran it, and it asked if I wanted to install an update (checking their update site on the internet). I said yes, and my virus checker (Avast) popped up with the following Malware/Adware error:

"Sign of "Win32:Vapsup-CW [Adw]" has been found in "C:\Program Files\CoPilot\Central\dll32.dll" file."

It then refuses to allow the software to run. I've tried uninstall/reinstalls, etc. but anywhere the (required to run CoPilot central) "dll32.dll" file is referenced (it gets put into a couple of different sub-directories during the update) causes this error. I can not execute CoPilot Central at this point and must uninstall it.

Not sure I want to install it if there is malware being installed.

Anybody else see anything like this? I was very excited to get this update, and now I'm not sure I even want it.

[LandRocket]

Unfortunately I believe you have been the victim of what's otherwise known as a "false positive". This happens because your virus scanner works using patterns. Sometimes a program has a similar pattern which triggers your virus scanner, but because it's not actually the same code, this is why you get a trigger message even though the virus/malware doesn't exist.

To try and put your mind at rest, I have the UK version, but I scanned the file you mentioned with both SpyBot S&D and McAfee Enterprise and got no reports back from either.

In case you wish to check the file size, my dll32.dll is 253,952 bytes.

Apart from that, if you are still worried about it, the only other avenue would be to zip a copy of the file up, password protect it, and then email it to support@avast.com letting them know of the password to the zip file. I am sure they would be quite happy to confirm to you that the file is indeed clean.

Hope this helps

[Smilodon]

Thanks. Yeah, I guess I can take that route, but thought I'd post this up in case anybody else was seeing it.

Unfortunately I don't see a way to ignore a particular file in this scenario.

Maybe I can post an MD5 for the file, but I think the first update that runs after the install tries to replace it, so there are probably different versions floating around already.

[LandRocket]

MD5 for my version is: cee757351be5b70029511572ed66930e

This is based on the Central app being at version 0.5.108.0

I also took a look on the shipped DVD and found dll32.dll there in E:\Program Files\CoPilot\Central

So, I took MD5 of this one and got: 6e949f2a05f2e423a03071301521788a

What I can tell you is that my DVD contained version 0.5.52.4

Hope this helps

We see you’re using an ad-blocker. We’re fine with that and won’t stop you visiting the site.
Have you considered making a donation towards website running costs?.
Or you could disable your ad-blocker for this site. We think you’ll find our adverts are not overbearing!