Go Back   FileForums > Support Forums > GameCopyWorld Support

Reply
 
Thread Tools Display Modes
  #1  
Old 06-11-2016, 13:05
RogerK RogerK is offline
User Awaiting Email Confirmation
 
Join Date: Nov 2016
Location: Austria
Posts: 4
Thanks: 0
Thanked 0 Times in 0 Posts
RogerK is on a distinguished road
Exclamation Malware in Flåklypa Grand Prix No-CD Patch

In Flåklypa Grand Prix Addon v1.0 [NORWEGIAN] No-CD/Fixed EXE, FGP.exe contains malware "Trojan horse PSW.Generic8.BOUD" according to virus scanner "AVG". See VirusTotal's report at: https://virustotal.com/en/file/89f42...is/1478461707/.
Reply With Quote
Sponsored Links
  #2  
Old 09-11-2016, 02:52
Joe Forster/STA's Avatar
Joe Forster/STA Joe Forster/STA is offline
Senior forum member
 
Join Date: Nov 2000
Location: Hungary
Posts: 9,348
Thanks: 4
Thanked 140 Times in 86 Posts
Joe Forster/STA is on a distinguished road
I think the file is clean. I've unpacked it (packed with FSG 2.0) with A) Quick Unpack 2.2 (Virustotal) and B) OllyDbg 1.10 + OllyDump (Virustotal). Option A) seems to be cleaner. Please, reply which one worked for you.
Attached Files
File Type: rar FGP1.RAR (2.5 KB, 2 views)
File Type: rar FGP2.RAR (2.7 KB, 1 views)
__________________
Joe Forster/STA
For more information, see the FileForums forum rules and the PC Games forum FAQ!
Don't contact me via E-mail or PM to ask for help with anything other than patches (or software in general) done by me, otherwise your request may be deleted without any reply!
Homepage: http://sta.c64.org, E-mail: sta@c64.rulez.org; for attachments, send compressed (ZIP or RAR) files only, otherwise your E-mail will bounce back!
Reply With Quote
The Following User Says Thank You to Joe Forster/STA For This Useful Post:
Grumpy (09-11-2016)
  #3  
Old 10-11-2016, 08:28
RogerK RogerK is offline
User Awaiting Email Confirmation
 
Join Date: Nov 2016
Location: Austria
Posts: 4
Thanks: 0
Thanked 0 Times in 0 Posts
RogerK is on a distinguished road
Unfortunately, I am not able to access the download links. I think it is because my account is awaiting activation (I have not received an email from fileforums).
Just curious, your first virustotal link shows 14/51 indicating that it is a virus. Does that mean it is clean and not a virus, even when some antivirus programs indicate trojan horse? Are No-CD fixes often falsely detected as viruses, when the original exe isen't?

Apart from that, where can I post a request for a No-CD exe fix? I think that Flåklypa Grand Prix is missing a No-CD fix for the latest verison of the game. Maybe someone can confirm / disconfirm this if I send them the original exe?
Reply With Quote
  #4  
Old 10-11-2016, 08:41
RogerK RogerK is offline
User Awaiting Email Confirmation
 
Join Date: Nov 2016
Location: Austria
Posts: 4
Thanks: 0
Thanked 0 Times in 0 Posts
RogerK is on a distinguished road
I also find it quite suspicious that the original FGP.exe is 254 kB, while the one I reported containing a malware is 5.11 kB. Why is that?
Reply With Quote
  #5  
Old 17-11-2016, 03:59
Joe Forster/STA's Avatar
Joe Forster/STA Joe Forster/STA is offline
Senior forum member
 
Join Date: Nov 2000
Location: Hungary
Posts: 9,348
Thanks: 4
Thanked 140 Times in 86 Posts
Joe Forster/STA is on a distinguished road
I put online the files for you: http://sta.c64.org/shared/gcw/fgp1.rar and http://sta.c64.org/shared/gcw/fgp2.rar. Packed/encrypted files - e.g. for copy protected, to make cracking difficult - often cause virus scanners to raise generic alarms. Sometimes even unpacked/unencrypted files, too. I looked into this program and it's not suspicious/sophisticated enough for a virus; you shouldn't worry about it.

As for virus alarms for no-CD patch vs. original file: original files are more often packed/encrypted against cracking and no-CD patches more often unpacked/unencrypted. However, if cracking was really difficult and/or the cracker is a bastard , he'll repack/reencrypt the no-CD patch so noone can see the changes involved in cracking it. Then the no-CD patch is also likely to raise a general alarm in virus scanners. There's not much you can do about it.

I don't understand your comment about file sizes. Stripping copy protection may A) decrease the file size because encryption code has been removed and/or B) increase the file size because encryption is most often applied to an already packed file. No-CD patches are likely to be significantly larger, because of B), than original files. When I cleaned the executable in two ways, those programs thought differently about which parts of memory are used, this is why the resulting executables have different sizes.

There's not much point in requesting no-CD patches here because crackers don't visit this forum. (Well, a few do, so you may have a chance.)
__________________
Joe Forster/STA
For more information, see the FileForums forum rules and the PC Games forum FAQ!
Don't contact me via E-mail or PM to ask for help with anything other than patches (or software in general) done by me, otherwise your request may be deleted without any reply!
Homepage: http://sta.c64.org, E-mail: sta@c64.rulez.org; for attachments, send compressed (ZIP or RAR) files only, otherwise your E-mail will bounce back!
Reply With Quote
  #6  
Old 23-11-2016, 07:49
RogerK RogerK is offline
User Awaiting Email Confirmation
 
Join Date: Nov 2016
Location: Austria
Posts: 4
Thanks: 0
Thanked 0 Times in 0 Posts
RogerK is on a distinguished road
Thank you for explaining the file size variations and the virus alarm from a no-CD patch. Now it makes a lot more sense to me. Unfortunately, the no-CD patch does not work, but that is not your fault. I think Flåklypa Grand Prix No-CD Patch is missing the latest version of the game. If anyone knows how to make a no-CD patch, then here is the exe: FGP.exe. Please let me know if this should be posted somewhere else instead.
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may post new threads
You may post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
C&C4 Tiberian Twilight patch 1.03 offline patch? Zocom7 Game Coders 0 15-06-2016 12:14
NecroVision Lost Company Patch 1.1 unpacking problem zzarko General Gaming 8 01-04-2011 10:09
El Matador Patch 1.15 Vlad87do PC Games 0 21-05-2010 06:36
Heroes4 patch 1.3 released: Veky PC Games 8 04-06-2002 05:02
help needed unable to patch mulan steven PSX Games 1 27-11-2001 09:00



All times are GMT -7. The time now is 03:22.


Powered by vBulletin® Version 3.8.9
Copyright ©2000 - 2017, vBulletin Solutions, Inc.
Copyright 2000-2017, FileForums @ http://fileforums.com