Trojan Horse

[Gben 20]

Strange news folks,

 

My weekly deep virus scan pulled up a new infection a few minutes ago. Nothing last week, but this week I apparently have a "Trojan Horse SHeur2.NFB".

 

But the reason I'm mentioning this is simply the file that was reported infected...

c:\games\westwood\ra2\yuri.exe

 

Weird. Because I haven't played that game for over months, even though I was actually thinking of playing in tonight. I can't find any information about the trojan that AVG discovered, but the scan is still active. I wonder what it will happen... and why *that* file. I *was* playing APB this week though...

 

Anyway, I thought it was mildly interesting, and relevant to the forums.

[Sonic 296]

Yeah Google turns up nothing on that virus/trojan name, and nothing to do with any virus associated with "YURI.EXE". I would suggest trying another anti-virus program. AVG is garbage anyway. Download Avast Home Edition from http://www.avast.com/eng/download-avast-home.html, its free and arguably the best of the free ones available. Remove AVG first before you install Avast though.

 

If you scan with Avast and it finds nothing than all is good.

[Gben 20]

It's strange that AVG's own virus encyclopedia doesn't have a listing... since it found it in the scan!

I have avast on another computer. I like it, but I'll try kaspersky's online scanner before switching...

 

EDIT:

 

I was talking about this yesterday when I realised something, which is probably the answer.

 

AVG tells me the yuri.exe is infected!

Avast tells me that rockpatch is a virus!

 

So my limited memory of the rock patch is that it moved away from 'mod', into a 'hack', which is probably why it shows up as a virus.

So bottom line I don't think I was infected afterall.

Edited February 6, 2009 by gben

[Mighty BOB! 5]

Ah, yeah the heuristics are probably just picking up the type of actions the patch performs and flagging that as an infection.

[Gben 20]

ROTFLOL!

 

UPDATE: Coincidently I was installing RA2/Yuri on a new computer yesterday. It flagged the yuri.exe on the actual original disk with the same virus. Those WESTWOOD guys... they created a virus that's taken years for the world to catch up and diagnose!

 

I literally had to turn off the AVG virus checker, to install the game. I've sent the file to the boffins at AVG, to agree with me that it's in fact not a virus.

Such a funny couple of days.

[Sonic 296]

Like I said before.... AVG is garbage, go get Avast from the link I posted above.

[Luk3us 63]

I must agree with Sonic, AVG isn't very good. My parents were using it, I installed Avast for them and it found a few trojans, and keyloggers, that AVG didn't see....

[CCHyper 3]

Just becuase some anti poo crap detected a executable, namely YR executable as a virus, does not mean it has one. Most of the time these things guess and target something stupid.

 

RockPatch does not have a virus, but someone did mirror one of the first releases and it did contain one, but that host took it down pretty much hours afterwards.

[Gben 20]

sok, I already sent the file/false-positive to them. Obviously the idea of creating a program that automatically discovers viruses before being confirmed by humans is going to give some grief... I can handle that.

[Malevolence 6]

Yuri has develop a new psychic inducing virus! Once the time is right the virus activates and you'll get mind controlled by looking at the BSOD. It's lucky you detect the virus early before it activates.

[Gben 20]

I just got a response back from AVG about the yuri virus. I sent them a copy of the yuri.exe, from my installation disc. Here is their response.

 

This email is an auto-response message. Please do not reply.

 

AVG Anti-virus Research Lab has analyzed the file(s) you have sent from your AVG Virus Vault. Below you can find the results for each file. The final verdict on the file is either a correct detection or a false positive detection.

 

Further information about the verdicts are available at our website:

http://www.avg.com/faq-1184

 

"C:\games\Westwood\RA2\YURI.exe" - detection is correct

 

 

 

Best regards,

 

AVG Technical Support

website: http://www.avg.com

 

Following quote from the website url given above...

 

The files you have sent us from your Virus Vault were analyzed, and the results are in the e-mail you have received. Here is a description of these results, and information how to proceed further.

 

1. Correct detection

 

In case the file is detected correctly, it will not be removed from the AVG detection. If you believe that the file should not be detected by AVG, please contact our Technical Support.

 

If you decide to keep the file and use it with the risk of possible payload it may carry, you can restore it from the AVG Virus Vault, and manually exclude it from the AVG detection:

 

* If the file is detected as a Potentially Unwanted Program

o Please open AVG - menu "Tools" - "Advanced settings" - "PUP Exceptions".

o Click "Add exception" and browse to the file.

* If the file is detected as a virus

o Please open AVG - menu "Tools" - "Advanced settings" - "Resident Shield" - "Exceptions".

o Enable the option "Use excludes in Resident Shield" and "Add path" to the folder which contains the file.

o Please note that the file will be still detected by AVG test. However, you can disable automatic healing in AVG - "Computer scanner" - double-click on scheduled scan - "How to scan" - disable the option "Automatically heal/remove infections".

 

Here's my followup email

 

I sent you a file which I believe has been incorrectly tagged as a virus. I believe this was a false positive.

 

You have anaylised this file, after I sent it to you, and the result is that you continue to treat a file taken off an installation cd for a computer game created/bought in 2001 as a virus.

 

Therefore I uninstalled your software and replaced it with another company's.

 

Thx.

 

Ben.

 

I post this information for posterity in case someone else googles the problem.

This was AVG version 8, February 2009. I don't know which actual database build because I uninstalled it and replaced with avast before I got this message.

 

[Luk3us 63]

I wonder if they're respond? I'll keep an eye on this thread for their response.

[Julbri 0]

quite a weird insidence really

[Fiesta 0]

This is why I use AntiVir with the pop-up forced off. Screw the other free stuff. Too bad NOD32 isn't free anymore.