0. Warcraft III Question. 05/29/2008 04:00:06 PM PDT
- My Anti Virus ShawSecure by F-Secure is picking up: sIntfnt.dll
as a Virus when attempt to run Warcraft III and or Frozen Throne.
- The WC III and WC III Frozen Throne CDs are the Retail ones and their CD keys are Valid
- Using Search programs I can find, rename, then delete:
sIntfnt.dll
sIntf16.dll
sIntf32.dll
but they are recreating themselves every time I Run the WC III CDs and F-Secure lists these as Gateway Trojans.
- Sorry this may be the wrong forum, but WC III is by Blizzard and I installed and played it on my new PC as a short diversion from the World of Warcraft.
- As a side note my College Computer Science Professor had this to say in an email:
"Hey Andrew,
Not sure what this is, but I do know that Sony was installing rootkits on PCs when their audio CDs were loaded.
A rootkit allows full remote access to a machine (another example is
SubSeven). They are considered trojan horses as they
allow the 'enemy' in through apparently helpful or non-harmful means.
David"
P.S. If by chance this is not related directly to the WC III CDs perhaps the Adobe Flash? The files were detected the same day as I updated one and installed the other in the final stages of setting up a new Windows XP PC.
3. Re: Warcraft III Question. 06/11/2008 03:52:40 PM PDT
My virus scanner (AVG Free Edition) detected "sintfnt.dll" as a virus a few days ago, too. I hit up Google in search of answers as to what it was, and found this forum about it. Weird, since I haven't tried running Warcraft 3 in a while myself. Booted up Warcraft 3 though, and sure enough, AVG caught Warcraft 3 trying to create this file (and four others) in my Temp folder.
Apparently it's some kind of copy protection that Blizzard uses to make sure you have the physical CD in your CD-ROM drive. Odd thing is, this has been in Warcraft 3... well... probably since Warcraft 3 was released. Why the virus scanners are only picking up on it now is beyond me.
An even stranger twist is, I sent "sintfnt.dll" off to AVG's lab to see if it might've been a false positive. Here's what I got back from them just a couple hours ago (my own emphasis added):
Q u o t e: Re: VVSAMPLE analysis
Tuesday, June 10, 2008 6:10 AM
From: "AVG Technical Support" <support@avg.com>
To: xxxxx@yahoo.com
This email is an auto-response message. Please do not reply.
AVG Anti-virus Research Lab has analyzed the file(s) you have sent from your AVG Virus Vault. Below you can find the results for each file. The final verdict on the file is either a correct detection or a false positive detection.
Further information about the verdicts are available at our website:
http://www.avg.com/faq-1184
"C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\sintfnt.dll" - detection is correct
