View previous topic :: View next topic |
Author |
Message |
Davethewave Expert Cheater
Reputation: 0
Joined: 06 Mar 2005 Posts: 210
|
Posted: Fri Nov 11, 2005 10:57 am Post subject: Trainer Virus? |
|
|
I recently was on my Linux OS (still am as I write this ) and was performing a virus check via "Anti-Vir" and it scanned my Windows partition, it claims that a couple of my trainers I made "Contains signature of the dropper Dropper/Small.acc.2" and was wondering if this could be a mistake on AntiVir's part, or perhaps a method of coding used to develop the trainers? Or is it possible that a virus attached itself to my trainer programs (and some how did not attach to any other program)? Thanks.. Just curious
|
|
Back to top |
|
 |
Dark Byte Site Admin
Reputation: 470
Joined: 09 May 2003 Posts: 25796 Location: The netherlands
|
Posted: Fri Nov 11, 2005 11:03 am Post subject: |
|
|
A couple? so not all?
I'd have to say it's a false positive. It's true that heuristics scan can see those trainers as a possible virus because the PE header hasn't been changed to incorporate the data it adds at the end of the trainer
thats why exe packers will mess up those trainers, but since the trainer stub is already packed (upx), thats no problem
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Like my help? Join me on Patreon so i can keep helping |
|
Back to top |
|
 |
Davethewave Expert Cheater
Reputation: 0
Joined: 06 Mar 2005 Posts: 210
|
Posted: Fri Nov 11, 2005 11:29 am Post subject: |
|
|
Hi, thanks.. by couple I mean all: I only have a couple sorry I need to be more careful.
|
|
Back to top |
|
 |
Davethewave Expert Cheater
Reputation: 0
Joined: 06 Mar 2005 Posts: 210
|
Posted: Thu Dec 01, 2005 8:04 pm Post subject: |
|
|
I asked Antivir about it, sounds like they don't care either *shrug* I will just remove my antivirus software completely, not like I ever use it and these messages that pop-up are annoying.
|
|
Back to top |
|
 |
cparty Expert Cheater
Reputation: 0
Joined: 01 Dec 2005 Posts: 219
|
Posted: Fri Dec 02, 2005 4:13 am Post subject: |
|
|
As DB already said probably a false positive. It happens often for the above mentioned reason.
However for small files (like trainers) you can check them online with several engines:
http://virusscan.jotti.org/
if only a few of them alert you of a virus you can be pretty sure its a false postive.
|
|
Back to top |
|
 |
Zhoul Master Cheater
Reputation: 1
Joined: 19 Sep 2005 Posts: 394
|
Posted: Fri Dec 02, 2005 1:55 pm Post subject: |
|
|
Davethewave wrote: | I asked Antivir about it, sounds like they don't care either *shrug* I will just remove my antivirus software completely, not like I ever use it and these messages that pop-up are annoying. |
I havn't used an active virus software for years.
I do, however, have some tools so you can investigate things like this on your own. In the example of a trainer, there's a pretty good chance you've already run it before, so running it again, if it were a virus, wouldn't do anything different , then the first time, most likely.
These 2 utils are great 'sniffers' to see what certain programs are doing.
http://www.sysinternals.com/Utilities/Filemon.html
http://www.sysinternals.com/utilities/regmon.html
Filemon monitors all reads/writes/accesses to your filesystem, and you can set filters, say for certain EXE's only, or certain directory structures only.
Regmon monitors all reads/writes/accesses to your registry. Same features as filemon.
Furthermore: I use the filemon util to find out what offsets and bytes are being modified, by 'trainers' that change save-game files. This: So I can incorporate that into my own trainers (theft, i know, but I always state where I do this, in the readme)
Semi-Off Topic:
Since I work tech support, I usually use these to make 'hot-fixes' for new worms/virii that come out, before network associates has a public release. I'll isolate a PC from the network, run file/regmon , then infect it to find all the changes. Then reverse engineer what the worm/virus did, and mass distribute automatically across the network Pretty spiffy setup.
|
|
Back to top |
|
 |
|