Author Topic: Infected game  (Read 3553 times)

0 Members and 1 Guest are viewing this topic.

Guys this is important message dont ignore it. I downloaded Diaspora from STRATEGY INFORMER and it was infected with Trojan Dropper win32.wor or something like this in the end ( i dont remember the 3 last letters) after that my laptop was doing like crazy and i found that diaspora was infected pls you have to believe me

 

Offline Flipside

  • əp!sd!l£
  • 212
I'm going to download and scan the file from SI over again, see if Avira spots anything, I'll post the outcome when I have it, should be 20 minutes ish :)

 

Offline Flipside

  • əp!sd!l£
  • 212
Ok, initial download scan was clear, Avira doesn't seem to be complaining about the file when I run the installer either. It wouldn't hurt for someone with Avast or the like to scan it as well just to be certain.

At what point did your Antivirus tell you of the infection, was it before or after you had installed it?

 

Offline karajorma

  • King Louie - Jungle VIP
  • Administrator
  • 214
    • Karajorma's Freespace FAQ
Does the MD5 match the one on the release thread Flipside? Cause if it does I find it hard to believe every single install of Diaspora had a virus. More likely it's a false positive.
Karajorma's Freespace FAQ. It's almost like asking me yourself.

[ Diaspora ] - [ Seeds Of Rebellion ] - [ Mind Games ]

 

Offline General Battuta

  • Poe's Law In Action
  • 214
  • i wonder when my postcount will exceed my iq
False positives with recent FSO builds are pretty common.

 
look i downloaded the game but it couldnt start installing for an unknown reason so i closed the firewall from my microsoft security essentials and it started installing (live protection) when it finished my windows vista, windows explorer was collapsing all the time i opened essentials and i found out this trojan at quarantine then i tried to delete diaspora cause this was the latest thing i downloaded for a week so i was 100% that this was the problem but i couldnt delete it cause when i was trying to do unnistal windows explorer was collapsing so i turned off again the live protection and i managed to unnistal diaspora, then i did full scan with my antivirus i deleted this trojan dropper win32 and i think that my laptop is safe but i am not 100%... i havent downloaded anything for a week and diaspora was the last thing wich downloaded the the problems start when i installed it.

 

Offline Fury

  • The Curmudgeon
  • 213
First, Security Essentials gives you detailed information what it found and where it was found. Please provide these details, you can review these from Security Essentials' history.

Second, please be aware that Diaspora was packaged in one humongous executable file (which was a stupid thing to do). Every single on-access anti-virus scanner will attempt to scan it thoroughly as soon as you open folder containing the file. This may result in Windows Explorer freezing, locking up or in extreme cases, even crashing (depending what on user does in confusion) until the scan is finished. Depending on anti-virus software in use as well as performance of your PC, this may take a good while.

My suspicion is that this "trojan" was found somewhere else, likely where the web browser you use stores temporary files. Or like mentioned earlier, was false positive. The explorer freezing, locking up or crashing is explained by on-access scanner doing its "magic" on the humongous Diaspora installer executable. Normally Explorer won't crash, but when it freezes and user attempts to operate it, Windows says it's not responding and user tries to close it, thus resulting in "crash".

 

Offline newman

  • Moderator
  • 211
I would also like to respectfully ask you to use a capital letter when starting a sentence, and to use interpunction signs to separate sentences and their parts. A few full stops and commas go a long way towards making posts readable - not using them makes posts much harder to make sense of. As for the rest, please follow the instructions Fury gave you, and maybe we can get to the bottom of this. But if Diaspora executable had a virus I'm fairly sure we'd know about it by now :)
« Last Edit: March 16, 2013, 06:50:22 pm by newman »
You know what the chain of command is? It's the chain I go get and beat you with 'til ya understand who's in ruttin' command here! - Jayne Cobb

 

Offline The E

  • He's Ebeneezer Goode
  • 213
  • Nothing personal, just tech support.
    • Steam
    • Twitter
To make clear what newman is saying: You are the first person to report a virus infection related to Diaspora in the entire time the game has been out.

Now, we're kinda used to certain antimalware packages freaking out about a few builds of the engine (which are always confirmed as false positives, btw), we've never seen one of the major distributions being actually tainted.

One thing that you could do would be to compare the MD5 hash of the installer you downloaded to the MD5 hash published in the release thread, that will tell you with 100% certainty whether or not the file you downloaded is the one we put up.

In addition, given the various vectors that malware can use to infect an unsuspecting machine, I am somewhat suspicious of your assertion that Diaspora must have been the file that caused all this (You say that Diaspora was the only file you downloaded for a week, if you have been online at all during that time, that statement is factually and provably false).

In conclusion, we're 99.99% certain that whatever caused your trouble was not caused by Diaspora. There are simple steps you can and should perform in order to be certain either way (Reread Fury's post in this thread).
If I'm just aching this can't go on
I came from chasing dreams to feel alone
There must be changes, miss to feel strong
I really need lifе to touch me
--Evergrey, Where August Mourns

 

Offline deathspeed

  • 29
  • i can't think of a good avatar
    • Steam
I just downloaded from there and scanned with Bitdefender and malwarebytes antimalware, and it came up clean on both.  I have had a lot of problems with bitdefender returning false positives but no probs with this download.
Maybe someday God will give you a little pink toaster of your own.

 

Offline jr2

  • The Mail Man
  • 212
  • It's prounounced jayartoo 0x6A7232
    • Steam
Could possibly be a redirect to an infected download site? I've seen that before.  But, as has been posted before, verify ing the MD5 hash will prove whether something like that happened or not.  I'd use HashTab to do it.

 

Offline Flipside

  • əp!sd!l£
  • 212
Sorry for the delay, the PSU exploded big-time on my computer. I'll re-download and double-check the MD5 tomorrow :)

 

Offline vic

  • 23
Funny/Scary that this came up.  I downloaded mine off of SI as well, and now AVG is refusing my ability to run the game, claiming generic30.cdjy trojan.

Update:  SCan of the 1.26GB Diaspora_R1_Windows.exe file came up clean.  Reinstalling now to see what I get.

Followup 1: Initial install came up fine.  Installed Diaspora_R1_Patch_1.0.4.exe, as soon as I launch Diaspora, AVG pops up with same virus detection.  Reinstalling again....
« Last Edit: March 30, 2013, 06:54:04 pm by vic »

 

Offline karajorma

  • King Louie - Jungle VIP
  • Administrator
  • 214
    • Karajorma's Freespace FAQ
I notice it's claiming a different virus. Does it say which file it thinks is infected?
Karajorma's Freespace FAQ. It's almost like asking me yourself.

[ Diaspora ] - [ Seeds Of Rebellion ] - [ Mind Games ]

 

Offline vic

  • 23
Yes, it claims this:

 fs2_open_Diaspora_R1_.exe

 

Offline vic

  • 23
Plain Jane Diaspora installs and plays fine, now moving on to install patch 3....

 

Offline vic

  • 23
Installation of Diaspora_R1_Patch_1.0.3.exe triggered a virus report.  Will uninstall, reinstall plain, then apply only patch 4.....Scan of Diaspora_R1_Patch_1.0.3.exe came back as clean

 

Offline vic

  • 23
Installation of either patch triggers AVG to call it a generic trojan virus, same I named earlier.  This is starting to feel like a day at the office :(

 

Offline General Battuta

  • Poe's Law In Action
  • 214
  • i wonder when my postcount will exceed my iq
Probably just the usual FSO false positive.

 

Offline vic

  • 23
I agree, false positive.  Added exception.  Question now is, in the launcher, the Profile management lists Diaspora, but no version number.  How do I tell that patch 4 installed?