Reported Post by yohojo

[YoHoJo]

yohojo has reported a post.

Reason:

Get this shit out of here.
Trent is just some RiD fag and trying to bash other bots.
Read posts below his, they are just false positives.

Post: Wbot
Forum: Runescape 2007 Cheating
Assigned Moderators: Gohan, Dalpra, Wolfdog, RsProd, -Ryan, RwmRS2

Posted by: Trent!
Original Content:

Now, I'm not trying to make any accusations with the following, but this is what happened after I accepted the ToS and click download, but before I pressed "keep file"

Fullscreen screenshot (1600x900 pixels): http://img266.imageshack.us/img266/3952/avasttrojanwbot.png

I get a pop-up from Avast! Antivirus:

The URL it mentions is (as copied from the HTML of that page:
http://www.wbot.nl/wbot.jar|{gzip}|org\objectweb\asm\util\CheckMethodAdapter.class http://www.wbot.nl/wbot.jar|{gzip}|org\o...

When I disable my AV and allow the download to come through, I scanned the wbot.jar individually and came up with 2 infections:

Viruses found even by a decompiler:

Uploading to Virustotal shows malicious files as well:
https://www.virustotal.com/en/file/...af0456a29b9de41b148b4df2/analysis/1362707584/


Now I don't know if it is two false positives, but with all of the above showing up, I'll be damned if I go anywhere near this bot or site ever again... unless they can provide documentation that proves the above is simply false positives (which I doubt). I'm pretty sure a legitimate Bot client shouldn't even have to worry about any false positives showing up because that only happens with code similar to malicious files.

Do with it what you want, all I know is I'm not using this.

 

Yessir!