Norton putting HB 4265 .exe on quarantine and deleting it

[swordofdawn]

Below is the full log:

Full Path: Not Available
____________________________
____________________________
On computers as of:
Not Available
Last Used:
at
Startup Item:
No
Launched:
Yes
____________________________
____________________________
Unknown
Number of users in the Norton Community that have used this file: Unknown
____________________________
High
This file risk is high.
____________________________
Threat Details
SONAR Protection monitors for suspicious program activity on your computer.
____________________________
Origin
Downloaded from URL Not Available

____________________________
File Actions
File: c:\Users\myUser\Desktop\HB4265\honorbuddy.exe
No Action Required
____________________________
System Settings Actions
Event: Process start (Performed by c:\users\myUser\desktop\hb4265\honorbuddy.exe, PID:5156)
No action taken
____________________________
Suspicious Actions
Event: Keystroke capture (Performed by c:\users\myUser\desktop\hb4265\honorbuddy.exe, PID:5156)
No action taken
Event: Attempt to start a remote thread in a process address space (Performed by c:\users\myUser\desktop\hb4265\honorbuddy.exe, PID:5156)
No action taken
____________________________
File Thumbprint - SHA:
Not Available
____________________________
File Thumbprint - MD5:
Not Available
____________________________



Any explanation/solution please?

 

[Apoc]

Norton is being overly anal about how we interact with WoW.

Honorbuddy does setup a very small keyboard hook (well, we don't, but .NET does) to handle "fake" input if a developer needs it. (Note: we do not provide facilities to 'log' any keystrokes an end-user does. Only things the bot does itself.)

We also start remote threads in WoW to handle injection, among other things.

It's been doing both of these since the beginning. Not sure why Norton is just now picking it up. You can add Honorbuddy to your AV's ignore list (or just disable your AV), and get around the issue. Unfortunately; we can't do a whole lot about it.

 

[swordofdawn]

Thanks for your[Faster than the speed of light] response Apoc!

 

[gemetzel]

Instancebuddy has a keylogger in it, it'll log your keystrokes and gain your accounts name and password!

lol.

 

[manse2750]

Instancebuddy has a keylogger in it, it'll log your keystrokes and gain your accounts name and password!

rofl.. seriously dude... rofl

 

[mvog2v1z5]

newb

 

[eemuman]

rly how newb am i ...

Bossland: last warning for this year

 

[fattony]

I see that Amroks stupid post was removed.

 

[Botanist]

For Norton users, just add the HB folder to the real time protection and scan exclusion list. It only takes about 30 seconds to it. Make sure to "tick" include subfolders.

 

[shuuk]

hmm intressting... i think bossland has something to tell us about this

 

[bigmanx]

Hmm , I get the same alert when trying to run the latest HB version. Weird thing is that at the previous version(4129) Norton doesn't detect a thing. I know av-s sometimes give false positives but why alert me at 4265 version and when I run the 4129 version nothing happens. I don't want to make crazy statements (like some people) but if someone could explain this alert I would be very pleased.

PS: I'm really paranoid and stuff and I used the 4129 version after that alert

 

[bigmanx]

NVM i saw the second reply by apoc, guess that makes sense.

 

[Croga]

Because instancebuddy has mal-code in it to steal your account data. it disconnects you very often and enables a keystroke logging while u enter ur account information

If you don't trust it:
- Get an authenticator
- Don't start HB until you're logged in (can't log in to HB before that anyway)

Problem solved, now go take that tinfoil hat elsewhere.

 

[james12]

my other thread got deleted lol ^^ with no answer

THERE IS something malicious inside ^^ if you dont trust me you are fools

Because there is corruption going on here and a lot of "hiding". I made this account because of the fear of having my active, main life time account banned before I can ask for a refund. I too have had my accounts stolen in the last few hours. Now I get to spend hours on the phone with Blizzard attempting to get back whats mine.

To all of the users who are saying "we will wait for a mod or admin to confirm" OPEN YOUR EYES! Who in their right mind would admit that there is malicious code in one of their plugins or bots? It would lose Bossland money and cause him to lose members. I've been MORE than faithful to this community over the last year. I've paid for lifetime, released several profiles and even a plugin on this board.

Once I get my lifetime refund, I'll be leaving this community for good.

 

[Narayan]

haha yer HB really steals your password information....... *sigh*

 

[BlackHer0]

:-D ololol stealing our passwords and accounts you not really thought we wouldn't get it.... But this is one of the best trys since a long time lol

 

[bossland]

Next time anyone accuses me to steal anything -> lets meet before court.

 

[MaiN]

yes since 4265

just do a bit reverse engeneering and u will find out urself

Stop being an idiot. If you have any proof show it, otherwise shut up. I can also make a picture of some code I wrote for the purpose of a screenshot. It doesn't automatically make it the truth or prove anything.

 

[Makelio]

Because there is corruption going on here and a lot of "hiding". I made this account because of the fear of having my active, main life time account banned before I can ask for a refund. I too have had my accounts stolen in the last few hours. Now I get to spend hours on the phone with Blizzard attempting to get back whats mine.

To all of the users who are saying "we will wait for a mod or admin to confirm" OPEN YOUR EYES! Who in their right mind would admit that there is malicious code in one of their plugins or bots? It would lose Bossland money and cause him to lose members. I've been MORE than faithful to this community over the last year. I've paid for lifetime, released several profiles and even a plugin on this board.

Once I get my lifetime refund, I'll be leaving this community for good.

have you ever think WHY on earth someone with 60wow acc's need more acc's??
have you ever think WHY someone like bossland with earnings more then 1000euro per month wanna loose this for 5-6 wow acc's?
have you ever think WHY PPL LIKE THIS TEAM DO SOMETHING LIKE THIS SINCE THEY KNOW OTHER PROGRAMMERS WILL FIND IT OUT?!!? :S
i mean come on... if you wanna leave just leave... dont spread the fear with stupid thinks...

 

[moujoohoo]

This just a scam.... HB don't steal anything


Love HB and the DEV team