Medal of Honor - Pacific Assault: Virus in noCD-exe?

[krondike]

I've scanned the latest version and virus deffinition with Kapersky Antivirus. No sign of virus.
Update your virus deffinition to the latest and it might change the result after a while.

Heard many people complaining that there Antivirus give a false alert! Some creaters of a program have to write in to the antivirus company to stop theme to report false...so yes this is a big problem!

[dunham]

Originally Posted by krondike

... Update your virus deffinition to the latest and it might change the result after a while.
...
Some creaters of a program have to write in to the antivirus company to stop theme to report false...so yes this is a big problem!

Sorry, it doesn't quite work that way. If a virus scanner reports a file to "probably contain an unknown virus", it means that the scanner has found suspicious code - not a known virus signature. The virus definition updates only contain the signatures of known viruses.

Unknown virus alerts are usually the result of a heuristic scan that checks for activities typical for viri (or is it viruses?). This includes self modifying code, access of ressources by unusual or undocumented means, self replication, etc.

In this case (F-Prot vs Pacific Assault) it seems that an overly sensitive virus scanner has met a program that is using some non-standard file access methods. At least that's my guess - no way to be sure without analyzing the code. Since the original mohpa.exe is not suspicious, something new has to be in the noCD crack that triggered the alert.

[krondike]

Well I couldn't find any example becuase didn't remember what program that it was. But I did find this on google.

http://www.giac.org/practical/GSEC/T...demir_GSEC.pdf