Medal of Honor - Pacific Assault: Virus in noCD-exe?

[tbaher]

wasn't there a certain RAR file that set off one of those "maybe" virus detectors
I think any copy protection that installs drivers without asking you first would be classified as viruses by a "maybe" scanner
*hates Race Driver 2 for that*

[GLH]

Scanned with AntiVir Personal Edition: No Virus !!!

[Stefan f]

i dont have the crack or original , but if the crack isnt packed , it should have the same excact file size then the original , also check if the original has the same problem

[dunham]

No, the original .exe does not register as "virus suspicious".

As usual, the cracked version is shorter than the original one:
The original is 10.889.623 Bytes long,
the noCD has 9.736.192 Bytes.

I used the suspicious mohpa.exe yesterday and have no further problems - so it's probably a false alarm. The only annoying thing is, that I have to disable virus protection to start the game.

[GLH]

Originally Posted by Stefan f

i dont have the crack or original , but if the crack isnt packed , it should have the same excact file size then the original , also check if the original has the same problem

That's not true !!!
Most of the time, cracks are smaler then the original file, because the copy protection is moved out !!!

[krondike]

I've scanned the latest version and virus deffinition with Kapersky Antivirus. No sign of virus.
Update your virus deffinition to the latest and it might change the result after a while.

Heard many people complaining that there Antivirus give a false alert! Some creaters of a program have to write in to the antivirus company to stop theme to report false...so yes this is a big problem!

[dunham]

Originally Posted by krondike

... Update your virus deffinition to the latest and it might change the result after a while.
...
Some creaters of a program have to write in to the antivirus company to stop theme to report false...so yes this is a big problem!

Sorry, it doesn't quite work that way. If a virus scanner reports a file to "probably contain an unknown virus", it means that the scanner has found suspicious code - not a known virus signature. The virus definition updates only contain the signatures of known viruses.

Unknown virus alerts are usually the result of a heuristic scan that checks for activities typical for viri (or is it viruses?). This includes self modifying code, access of ressources by unusual or undocumented means, self replication, etc.

In this case (F-Prot vs Pacific Assault) it seems that an overly sensitive virus scanner has met a program that is using some non-standard file access methods. At least that's my guess - no way to be sure without analyzing the code. Since the original mohpa.exe is not suspicious, something new has to be in the noCD crack that triggered the alert.

[krondike]

Well I couldn't find any example becuase didn't remember what program that it was. But I did find this on google.

http://www.giac.org/practical/GSEC/T...demir_GSEC.pdf