Howdy,
As I logged on today on WoW, my antivirus raised a virus alert for the file Scan.dll in WoW’s installation folder. I am using Avast 4.8 Home Edition (Virus Database 081028-0 dating from today). It is probably a false positive, but it is also possible that my WoW install has been infected with something (since some malware specifically targets WoW accounts). Since I don’t want to lose all my precious gold, I preferred checking a few things before logging in.
Here is a VirusTotal scan of the suspicious file Scan.dll: http://www.virustotal.com/fr/analisis/2b23aa39412bdfffdc8e8f34215de118. Here is what we can learn from this:
- only 3/36 antiviruses flag scan.dll as suspicious (which is low but still more than one)
- all raise generic alerts such as “suspicious file” and “Win32:Trojan-gen {Other}”. In plain English, this means “I have no idea what this file does, however it is protected against analysis and I am better off raising a scary alert”.
- according to multiple tools the file is packed with UPX.
Hopefully, UPX is a really weak protection and the official release can unpack the file for us. So, all we have to do is download the latest UPX release, install it and unpack Scan.dll:
D:\test\upx303w>upx -d Scan.dll -o UnpackedScan.dll Ultimate Packer for eXecutables Copyright (C) 1996 - 2008UPX 3.03w Markus Oberhumer, Laszlo Molnar & John Reiser Apr 27th 2008 File size Ratio Format Name -------------------- ------ ----------- ----------- 90372 <- 39684 43.91% win32/pe UnpackedScan.dll Unpacked 1 file.
Now that we have an unpacked Scan.dll, let’s check again what Virus Total has to tell us: http://www.virustotal.com/fr/analisis/fdfe09829e1dd865144d6f80313209c4
This time, we have 0/36 detection rate, and the file does not seem to include additional layers of protection (which means it can now be fully analysed by antivirus engines).
Conclusion: it was the UPX protection layer that caused the new Avast and eSafe alert. Therefore this alert is a false positive, Scan.dll is not infected and you can go back to murloc farming. What is strange however is that UPX is a really common packer, I’m wondering exactly what part of it is confusing Avast’s heuristics.
Ok I didn’t understand anything above, what should I do/know ?
- at the time of writing, Scan.dll is not a virus
- the alert only comes from Avast and related antiviruses
- when Avast asks you what to do, choose Nothing. On the next virus database update, the alert will probably be removed.
- if you chose Quarantine, try to restore the file since WoW will probably complain that you messed with one of its DLLs.
Here is the post dealing with this issue on the official forums.
Indefinite Studies 
Your conclusions are not that accurate
if UPX is getting flagged by AV software, think what happens with this shitty Avast and executables packed with less popular packers/compressors ;)
Srry to say blizzard is using this as a spy tool
Blue Post:
This is nothing to worry about. We occasionally check the hardware specifications on your computer to know what types of computers our customers are using. Please be assured we do not check for any personal information. We’re strictly looking for CPU speed, amount of RAM, video card information, and similar non-personal information.
I smell Trouble and thats invaiding privacy
Trend Micro also flags scan.dll as a virus. However, I don’t necessarily believe it is a false reading. If you delete the file, WoW will not give you a nasty message or anything. When you access the WoW login screen, a file called scan.dll.new is created. A file with the suffix of “.new” is not executable, so antivirus software won’t flag it.
The file can be deleted immediately while WoW is running without error messages, so it doesn’t seem to me as though it is something Blizzard is using to read non-personal system information. If you start WoW while scan.dll.new is in the WoW folder, the file is renamed to scan.dll, and now that it has the suffix of an executable file, Trend Micro immediately identifies it as a keylogger Trojan virus. It only started identifying this virus a couple of months ago.
– John Silver