Malware in Flåklypa Grand Prix No-CD Patch

[RogerK]

In Flåklypa Grand Prix Addon v1.0 [NORWEGIAN] No-CD/Fixed EXE (http://www.gamecopyworld.eu/games/pc_flaklypa_gp.shtml#Flåklypa Grand Prix Addon v1.0 [NORWEGIAN] No-CD/Fixed EXE), FGP.exe contains malware "Trojan horse PSW.Generic8.BOUD" according to virus scanner "AVG". See VirusTotal's report at: https://virustotal.com/en/file/89f42631e9c7b91a5313246eeb39522b4bc9550919fe5e070a 66e35f1b84c460/analysis/1478461707/.

[Joe Forster/STA]

I think the file is clean. I've unpacked it (packed with FSG 2.0) with A) Quick Unpack 2.2 (Virustotal (https://virustotal.com/en/file/b88ee41a42953501a0fc1f25e66a240ceacc1cbd221f40b855 03c47e0ab2c4b1/analysis/1478684833/)) and B) OllyDbg 1.10 + OllyDump (Virustotal (https://virustotal.com/en/file/5d526576ae754aadbd0975143cf779e9c48262370c0f569fcc 62d34af65bb81e/analysis/1478684855/)). Option A) seems to be cleaner. Please, reply which one worked for you.

[RogerK]

Unfortunately, I am not able to access the download links. I think it is because my account is awaiting activation (I have not received an email from fileforums).
Just curious, your first virustotal link shows 14/51 indicating that it is a virus. Does that mean it is clean and not a virus, even when some antivirus programs indicate trojan horse? Are No-CD fixes often falsely detected as viruses, when the original exe isen't?

Apart from that, where can I post a request for a No-CD exe fix? I think that Flåklypa Grand Prix (http://www.gamecopyworld.eu/games/pc_flaklypa_gp.shtml) is missing a No-CD fix for the latest verison of the game. Maybe someone can confirm / disconfirm this if I send them the original exe?

[RogerK]

I also find it quite suspicious that the original FGP.exe is 254 kB, while the one I reported containing a malware is 5.11 kB. Why is that?

[Joe Forster/STA]

Files are attached. Packed/encrypted files - e.g. for copy protected, to make cracking difficult - often cause virus scanners to raise generic alarms. Sometimes even unpacked/unencrypted files, too. I looked into this program and it's not suspicious/sophisticated enough for a virus; you shouldn't worry about it.

As for virus alarms for no-CD patch vs. original file: original files are more often packed/encrypted against cracking and no-CD patches more often unpacked/unencrypted. However, if cracking was really difficult and/or the cracker is a bastard ;), he'll repack/reencrypt the no-CD patch so noone can see the changes involved in cracking it. Then the no-CD patch is also likely to raise a general alarm in virus scanners. There's not much you can do about it.

I don't understand your comment about file sizes. Stripping copy protection may A) decrease the file size because encryption code has been removed and/or B) increase the file size because encryption is most often applied to an already packed file. No-CD patches are likely to be significantly larger, because of B), than original files. When I cleaned the executable in two ways, those programs thought differently about which parts of memory are used, this is why the resulting executables have different sizes.

There's not much point in requesting no-CD patches here because crackers don't visit this forum. (Well, a few do, so you may have a chance.)

[RogerK]

Thank you for explaining the file size variations and the virus alarm from a no-CD patch. Now it makes a lot more sense to me. Unfortunately, the no-CD patch does not work, but that is not your fault. I think Flåklypa Grand Prix No-CD Patch (http://www.gamecopyworld.eu/games/pc_flaklypa_gp.shtml) is missing the latest version of the game. If anyone knows how to make a no-CD patch, then here is the exe: FGP.exe (http://www.mediafire.com/file/j19tauuqahksxli/FGP.exe). Please let me know if this should be posted somewhere else instead.