Malware in Flåklypa Grand Prix No-CD Patch
 

In Flåklypa Grand Prix Addon v1.0 [NORWEGIAN] No-CD/Fixed EXE, FGP.exe contains malware "Trojan horse PSW.Generic8.BOUD" according to virus scanner "AVG". See VirusTotal's report at: https://virustotal.com/en/file/89f42...is/1478461707/.

I think the file is clean. I've unpacked it (packed with FSG 2.0) with A) Quick Unpack 2.2 (Virustotal) and B) OllyDbg 1.10 + OllyDump (Virustotal). Option A) seems to be cleaner. Please, reply which one worked for you.

Unfortunately, I am not able to access the download links. I think it is because my account is awaiting activation (I have not received an email from fileforums).
Just curious, your first virustotal link shows 14/51 indicating that it is a virus. Does that mean it is clean and not a virus, even when some antivirus programs indicate trojan horse? Are No-CD fixes often falsely detected as viruses, when the original exe isen't?

Apart from that, where can I post a request for a No-CD exe fix? I think that Flåklypa Grand Prix is missing a No-CD fix for the latest verison of the game. Maybe someone can confirm / disconfirm this if I send them the original exe?

I also find it quite suspicious that the original FGP.exe is 254 kB, while the one I reported containing a malware is 5.11 kB. Why is that?

Files are attached. Packed/encrypted files - e.g. for copy protected, to make cracking difficult - often cause virus scanners to raise generic alarms. Sometimes even unpacked/unencrypted files, too. I looked into this program and it's not suspicious/sophisticated enough for a virus; you shouldn't worry about it.

As for virus alarms for no-CD patch vs. original file: original files are more often packed/encrypted against cracking and no-CD patches more often unpacked/unencrypted. However, if cracking was really difficult and/or the cracker is a bastard ;), he'll repack/reencrypt the no-CD patch so noone can see the changes involved in cracking it. Then the no-CD patch is also likely to raise a general alarm in virus scanners. There's not much you can do about it.

I don't understand your comment about file sizes. Stripping copy protection may A) decrease the file size because encryption code has been removed and/or B) increase the file size because encryption is most often applied to an already packed file. No-CD patches are likely to be significantly larger, because of B), than original files. When I cleaned the executable in two ways, those programs thought differently about which parts of memory are used, this is why the resulting executables have different sizes.

There's not much point in requesting no-CD patches here because crackers don't visit this forum. (Well, a few do, so you may have a chance.)

Thank you for explaining the file size variations and the virus alarm from a no-CD patch. Now it makes a lot more sense to me. Unfortunately, the no-CD patch does not work, but that is not your fault. I think Flåklypa Grand Prix No-CD Patch is missing the latest version of the game. If anyone knows how to make a no-CD patch, then here is the exe: FGP.exe. Please let me know if this should be posted somewhere else instead.