[SPACECRUISER]

Guys this is important message dont ignore it. I downloaded Diaspora from STRATEGY INFORMER and it was infected with Trojan Dropper win32.wor or something like this in the end ( i dont remember the 3 last letters) after that my laptop was doing like crazy and i found that diaspora was infected pls you have to believe me

[Flipside]

I'm going to download and scan the file from SI over again, see if Avira spots anything, I'll post the outcome when I have it, should be 20 minutes ish

[Flipside]

Ok, initial download scan was clear, Avira doesn't seem to be complaining about the file when I run the installer either. It wouldn't hurt for someone with Avast or the like to scan it as well just to be certain.

At what point did your Antivirus tell you of the infection, was it before or after you had installed it?

[karajorma]

Does the MD5 match the one on the release thread Flipside? Cause if it does I find it hard to believe every single install of Diaspora had a virus. More likely it's a false positive.

[General Battuta]

False positives with recent FSO builds are pretty common.

[SPACECRUISER]

look i downloaded the game but it couldnt start installing for an unknown reason so i closed the firewall from my microsoft security essentials and it started installing (live protection) when it finished my windows vista, windows explorer was collapsing all the time i opened essentials and i found out this trojan at quarantine then i tried to delete diaspora cause this was the latest thing i downloaded for a week so i was 100% that this was the problem but i couldnt delete it cause when i was trying to do unnistal windows explorer was collapsing so i turned off again the live protection and i managed to unnistal diaspora, then i did full scan with my antivirus i deleted this trojan dropper win32 and i think that my laptop is safe but i am not 100%... i havent downloaded anything for a week and diaspora was the last thing wich downloaded the the problems start when i installed it.

[Fury]

First, Security Essentials gives you detailed information what it found and where it was found. Please provide these details, you can review these from Security Essentials' history.

Second, please be aware that Diaspora was packaged in one humongous executable file (which was a stupid thing to do). Every single on-access anti-virus scanner will attempt to scan it thoroughly as soon as you open folder containing the file. This may result in Windows Explorer freezing, locking up or in extreme cases, even crashing (depending what on user does in confusion) until the scan is finished. Depending on anti-virus software in use as well as performance of your PC, this may take a good while.

My suspicion is that this "trojan" was found somewhere else, likely where the web browser you use stores temporary files. Or like mentioned earlier, was false positive. The explorer freezing, locking up or crashing is explained by on-access scanner doing its "magic" on the humongous Diaspora installer executable. Normally Explorer won't crash, but when it freezes and user attempts to operate it, Windows says it's not responding and user tries to close it, thus resulting in "crash".

[newman]

I would also like to respectfully ask you to use a capital letter when starting a sentence, and to use interpunction signs to separate sentences and their parts. A few full stops and commas go a long way towards making posts readable - not using them makes posts much harder to make sense of. As for the rest, please follow the instructions Fury gave you, and maybe we can get to the bottom of this. But if Diaspora executable had a virus I'm fairly sure we'd know about it by now

[The E]

To make clear what newman is saying: You are the first person to report a virus infection related to Diaspora in the entire time the game has been out.

Now, we're kinda used to certain antimalware packages freaking out about a few builds of the engine (which are always confirmed as false positives, btw), we've never seen one of the major distributions being actually tainted.

One thing that you could do would be to compare the MD5 hash of the installer you downloaded to the MD5 hash published in the release thread, that will tell you with 100% certainty whether or not the file you downloaded is the one we put up.

In addition, given the various vectors that malware can use to infect an unsuspecting machine, I am somewhat suspicious of your assertion that Diaspora must have been the file that caused all this (You say that Diaspora was the only file you downloaded for a week, if you have been online at all during that time, that statement is factually and provably false).

In conclusion, we're 99.99% certain that whatever caused your trouble was not caused by Diaspora. There are simple steps you can and should perform in order to be certain either way (Reread Fury's post in this thread).

[deathspeed]

I just downloaded from there and scanned with Bitdefender and malwarebytes antimalware, and it came up clean on both.  I have had a lot of problems with bitdefender returning false positives but no probs with this download.

[jr2]

Could possibly be a redirect to an infected download site? I've seen that before.  But, as has been posted before, verify ing the MD5 hash will prove whether something like that happened or not.  I'd use HashTab to do it.

[Flipside]

Sorry for the delay, the PSU exploded big-time on my computer. I'll re-download and double-check the MD5 tomorrow

[vic]

Funny/Scary that this came up.  I downloaded mine off of SI as well, and now AVG is refusing my ability to run the game, claiming generic30.cdjy trojan.

Update:  SCan of the 1.26GB Diaspora_R1_Windows.exe file came up clean.  Reinstalling now to see what I get.

Followup 1: Initial install came up fine.  Installed Diaspora_R1_Patch_1.0.4.exe, as soon as I launch Diaspora, AVG pops up with same virus detection.  Reinstalling again....

[karajorma]

I notice it's claiming a different virus. Does it say which file it thinks is infected?

[vic]

Yes, it claims this:

 fs2_open_Diaspora_R1_.exe

[vic]

Plain Jane Diaspora installs and plays fine, now moving on to install patch 3....

[vic]

Installation of Diaspora_R1_Patch_1.0.3.exe triggered a virus report.  Will uninstall, reinstall plain, then apply only patch 4.....Scan of Diaspora_R1_Patch_1.0.3.exe came back as clean

[vic]

Installation of either patch triggers AVG to call it a generic trojan virus, same I named earlier.  This is starting to feel like a day at the office

[General Battuta]

Probably just the usual FSO false positive.

[vic]

I agree, false positive.  Added exception.  Question now is, in the launcher, the Profile management lists Diaspora, but no version number.  How do I tell that patch 4 installed?