New Gp2x Infected?

[EvilDragon]

depends where the file was, if it was on the nand when the op got the 2x then it must have been shipped with the virus, if a sd card was plugged in, it might have sneaked onto the sd card and then when the 2x was plugged in it could have shown as being infected...

hmmm, I thought new gp2x's were shipping with fw3.0 by default, which doesn't allow access to the nand via usb? Or am I mistaken?

I've certainly heard something along those lines


It allows access to the NAND to the normal storage, not to the main Linux system (so only /mnt/nand)

However, since I can't imagine that GPH ever changed FW3.0.0, it's pretty unlikely.
It's an image file that gets written onto the NAND in the factory, so they'd need to change that original image file...
I don't have the latest batch yet and won't get it before July 9th since I'm on holidays next week, but I'll test some.

 

[Squidge]

Ok, so it seems like either the company you bought it from plugged it into usb for some reason and copied the virus to it during testing (unlikely, I can see them switching it on to make sure it works, but not playing with the usb cable).

Or, a virus got transferred to it when the OP plugged it in.

Since this is the first post about such a virus, I would expect the later.

 

[Hooka]

Unfortunately, this kinda wories me (I've never used fw3.0.0, and I don't have Windows, but...) seeing as there's been problems with people picking up trojans off of the GP2X.com site... Hopefully this is just a freak occurance. Maybe somebody should check the fw3.0.0 upgrade...

 

[Squidge]

I can't even unpack the 3.0.0 upgrade on a normal linux box, nevermind the gp2x itself, so there's not much chance of a virus hiding in there...

(The 3.0 rip however, seems fine)

 

[trooper]

If this was the case, and AVG found it on the GP2X, surely it would have found it on the PC beforehand.

Maybe people could actually consider listening to the OP, instead of dismissing this entirely as his own fault.

I was simply offering a couple of rational explanations to a situation that seemed like blind panic and instant blame, As the original poster seem adamant that the virus had originated from the GP2x, And the virus scan was done on "an old windows box". But how does asking questions to find out more details about said situation give the impression that the original poster opinions are being dismissed ?.

Trooper

 

[pig2x]

A belated (my ISP is being rubbish) answer to those perfectly legitimate questions: I run various flavours of Debian Linux on all my boxes apart from the aforementioned Windows XP box, which is and was absolutely up-to-date with all updates for XP, ZoneAlarm, SpybotS+D, AdAware, and AVG anti-virus. My Debian boxes are not infected, my flash memory cards are not infected, and the Windows box is not infected. I found the dubious file via a Debian box, scanned it with AVG via a Windows box, then looked it up via Google. I honestly can't see how it could be sitting on my GP2X unless it was so delivered to me by the distributor. As the distributor isn't returning calls, I floated the question here.

 

[Dragon Flame]

Anybody else found that their new GP2X arrived with the RavMonE.exe virus sitting on it?

Just letting everyone know that I also have the RavMonE.exe on my GP2X, I bought it from http://gp2x.net.au/
Its the 3.0 pack, the RavMonE.exe file has recorded it as being created on the 10th of april 2007 which is a good month before I bought it. So I can only assume that it was shipped with the virus or it was put on at a later date by the distributor.
I have run into this virus on a few macs back when i was in Uni and it can be hard to get rid of.
By the way its only on the Nand not my SD nor any of my USB Keys or External HD. After Deleting it it has never returned. Knowing all this im cerain that it was already on my GP2X before buying it.

If people are looking for it it should be on the Nand in the top directory. Its 1mb is size.

 

[pig2x]

Update:

In the five months since I reported this to the distributor (and mentioned it here) I have had no response whatsoever from the distributor.

The distributor also never responded to my inquiry about a cradle power supply. Anybody else want to sell me one?

I did recently receive an advertisement for the new GPThingy, but, as you can imagine, I won't be buying one.

 

[icurafu]

This virus attaches itself to devices as they are mounted. It might have jumped across when you mounted if your PC was infected. Or a distributor who tested it may have caused the virus.

Easy enough to remove and get on with your life rather than waiting months.

Pretty cr@p about the PSU for the BoB I agree.

 

[Dan2552]

When I recieve mine (it'll be dispatched when they come back in stock which apparently should be Monday) I'll see if I have it. Not really worrying me as I'm using Linux.

 

[craigix]

There is no virus in the 3.0 firmware. Around 4000 units shipped with it and only one person reported it...

 

[Goity]

I got the virus. I ordered my gp2x from gp32x.de I think.

 

[Alex.]

Just the kind of publicity the GP2X needs... <_<

 

[Dan2552]

I wouldn't really call 1 single thread "publicity".

Besides, it cant do harm unless the person actually runs it themself, USB doesn't have an autorun function like CDROMs do in Windows anyway.

 

[StealthBagel]

It seems pretty likely this would happen on units bought from some manufacturers since the units are probably just loaded with software via USB from a PC... any infected PC could easily pass it along to the gp2x.... the best approach would really be to load the gp2x units from a dedicated PC with no other (non critical) software on it, and no internet connection...

 

[icurafu]

Unless gph are insane, I'm sure the nand is preloaded in the factory before being stamped on the board.

 

[craigix]

It is preloaded on to the chip, and we don't open or check them before shipping them. It would have had to have been someone at the factory who for some reason hooked it up to a PC or something like that. It certainly isn't in the 3.0 firmware.

 

[bacteria]

You always used to check the GP2x units before sending them out. A guy on YouTube couldn't get his SD card to pop out (had to open the system up to release the card inside) and the on/off switch wasn't mounted properly so he couldn't turn the system on until he opened the case and corrected the issue. This was a brand new model, straight out of the box, bought from you craigix. In the old days it would have been tested before dispatch. Worrying that at least one unit has been sent out with a virus attached.