Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


Trainer Virus?

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine
View previous topic :: View next topic  
Author Message
Davethewave
Expert Cheater
Reputation: 0

Joined: 06 Mar 2005
Posts: 210

PostPosted: Fri Nov 11, 2005 10:57 am    Post subject: Trainer Virus? Reply with quote

I recently was on my Linux OS (still am as I write this Wink ) and was performing a virus check via "Anti-Vir" and it scanned my Windows partition, it claims that a couple of my trainers I made "Contains signature of the dropper Dropper/Small.acc.2" and was wondering if this could be a mistake on AntiVir's part, or perhaps a method of coding used to develop the trainers? Or is it possible that a virus attached itself to my trainer programs (and some how did not attach to any other program)? Thanks.. Just curious Smile
Back to top
View user's profile Send private message
Dark Byte
Site Admin
Reputation: 470

Joined: 09 May 2003
Posts: 25796
Location: The netherlands

PostPosted: Fri Nov 11, 2005 11:03 am    Post subject: Reply with quote

A couple? so not all?

I'd have to say it's a false positive. It's true that heuristics scan can see those trainers as a possible virus because the PE header hasn't been changed to incorporate the data it adds at the end of the trainer

thats why exe packers will mess up those trainers, but since the trainer stub is already packed (upx), thats no problem

_________________
Do not ask me about online cheats. I don't know any and wont help finding them.

Like my help? Join me on Patreon so i can keep helping
Back to top
View user's profile Send private message MSN Messenger
Davethewave
Expert Cheater
Reputation: 0

Joined: 06 Mar 2005
Posts: 210

PostPosted: Fri Nov 11, 2005 11:29 am    Post subject: Reply with quote

Hi, thanks.. by couple I mean all: I only have a couple Wink sorry I need to be more careful.
Back to top
View user's profile Send private message
Davethewave
Expert Cheater
Reputation: 0

Joined: 06 Mar 2005
Posts: 210

PostPosted: Thu Dec 01, 2005 8:04 pm    Post subject: Reply with quote

I asked Antivir about it, sounds like they don't care either *shrug* I will just remove my antivirus software completely, not like I ever use it and these messages that pop-up are annoying.
Back to top
View user's profile Send private message
cparty
Expert Cheater
Reputation: 0

Joined: 01 Dec 2005
Posts: 219

PostPosted: Fri Dec 02, 2005 4:13 am    Post subject: Reply with quote

As DB already said probably a false positive. It happens often for the above mentioned reason.
However for small files (like trainers) you can check them online with several engines:
http://virusscan.jotti.org/
if only a few of them alert you of a virus you can be pretty sure its a false postive.
Back to top
View user's profile Send private message
Zhoul
Master Cheater
Reputation: 1

Joined: 19 Sep 2005
Posts: 394

PostPosted: Fri Dec 02, 2005 1:55 pm    Post subject: Reply with quote

Davethewave wrote:
I asked Antivir about it, sounds like they don't care either *shrug* I will just remove my antivirus software completely, not like I ever use it and these messages that pop-up are annoying.

I havn't used an active virus software for years.

I do, however, have some tools so you can investigate things like this on your own. In the example of a trainer, there's a pretty good chance you've already run it before, so running it again, if it were a virus, wouldn't do anything different , then the first time, most likely.

These 2 utils are great 'sniffers' to see what certain programs are doing.

http://www.sysinternals.com/Utilities/Filemon.html


http://www.sysinternals.com/utilities/regmon.html


Filemon monitors all reads/writes/accesses to your filesystem, and you can set filters, say for certain EXE's only, or certain directory structures only.

Regmon monitors all reads/writes/accesses to your registry. Same features as filemon.

Furthermore: I use the filemon util to find out what offsets and bytes are being modified, by 'trainers' that change save-game files. This: So I can incorporate that into my own trainers (theft, i know, but I always state where I do this, in the readme)

Semi-Off Topic:
Since I work tech support, I usually use these to make 'hot-fixes' for new worms/virii that come out, before network associates has a public release. I'll isolate a PC from the network, run file/regmon , then infect it to find all the changes. Then reverse engineer what the worm/virus did, and mass distribute automatically across the network Wink Pretty spiffy setup.
Back to top
View user's profile Send private message AIM Address
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites