❗ Virus?? Wth??

Alright i dont know whats going on with the files on this site, but alot of files that i download end up getting detected with malware and trojans, mainly mhwalker and versions of vinpub. I will try to gather screenshots.

So last night i downloaded the new mhwalker 0.929 and vinpub 6.0-6.1 to try them out and well they came back with detections, and its not all versions. 0.928 and 23 were not detected by nx(for me at least) or anti virus. After i downloaded them a little while later i got this popup for win 7 2012 antivirus, which is no doubt malware and false positives
on top of that the errors and trojans that rose about were

Trojan.msil.agent.gqw (not sure which file but came from the same folder as everything else)
trojan.downloader.win32.agent.bxoj(not sure which file but came from the same folder as everything else)
Monitor.perflogger.ahs(.akp)(.akv) multiple ones there and that came from vinpub 6.1
Trojan.win32.chifrax.cya which came from mhwalker 09.29
unknown threat uds.dangerousobject.multi.generic(not sure which file but came from the same folder as everything else)

Now, should i be worried about this or just stick to the older stuff that i have? like they say if it aint broke, dont fix it and the older stuff works perfectly, accept god mode which isnt that big a deal.

Any opinions would be appreciated and like i said i will try and gather screenshots

Could be just fake reports ..

Considering that many people reporting having the same problem (win7 2012 antivirus), I'd say it may not be fake report. Better get some mod to look into it

It's fine for me, nothing at all.

THE FILES YOU DOWNLOAD FROM MY SECTIONS HAVE NO VIRUS OR ANYTHING LIKE THAT. YOU MAKE ME SOUND USELESS, YA KNOW?
If your antivirus detects these files as virus, its a false positive.

Originally Posted by Nico

THE FILES YOU DOWNLOAD FROM MY SECTIONS HAVE NO VIRUS OR ANYTHING LIKE THAT. YOU MAKE ME SOUND USELESS, YA KNOW?
If your antivirus detects these files as virus, its a false positive.

Just making sure, you could never be "too careful." it's weird that not all were detected so thats why i was worried, plus the word trojan gets your blood flowing xD

A lot of the files are packed in order to avoid detection by the game. Your A/V will usually pick up a packed file and flag it as a potential threat, regardless of content, because of the very real risk that the packing hides a virus. It's simply a case of false positives, and I fully trust Nico to do what he must.

It's true that when antivirus software sees a packed and encrypted file, it assumes the worst. There's nothing malevolent in the file but the antivirus can't scan the code because it's encrypted. This is done by myself and several others for several reasons. Not the least of which is to hide the actual code being run so that Nexon has a much harder time patching the exploits we're using. They can't patch it if they don't know what to patch.

Packing is only part of the problem in the case of MHWalker. Some of the code in MHWalker does use virus-like behavior. It does scan your keyboard looking for you to press hotkeys. It does send keyboard and mouse commands to windows that it doesn't own. See where I'm going with this?

I can only speak for myself, but no download from me will ever contain a virus, trojan or any other malicious software. I'm here to help, not screw everyone over. The source code for my uploads is regularly checked by MPGH staff. Even staff uses my software and code.

From what I can tell looking at other posts by dave, and others the problem isn't in the files, it's in the site.
There's a good chance that one of our members visited a site that contains malware, then somehow transferred it to the server (it's possible, although unlikely)
There was a site up for EVER called jl.chura.xxx (google it if you want info. The extension was .pl) that was up for almost ten years spreading a mutex that would infect all html files on both your system, and any page you visited. It's since been shut down (to my knowledge) but that gives you a good example of how this could happen, and what you're looking at.

I highly doubt that anyone's able to sneak anything past us since most of the time we're checking the files among multiple members, and we use many different methods of "reading" to disassemble, and determine what's inside the files. Packed or not.

Why do the old versions not have these false positives? What new features did you add that cause this?

Originally Posted by sky_dragon

Why do the old versions not have these false positives? What new features did you add that cause this?

HD's first consoles werent packed, nowadays everything is.

Packing, and encryption.
The methods that we use to prevent people from stealing our work are what's triggering your A/V.
More about this can be read two posts ahead >.<

❗ Virus?? Wth??

Similar Threads

Tags for this Thread