It seems that you're using an outdated browser. Some things may not work as they should (or don't work at all).
We suggest you upgrade newer and better browser like: Chrome, Firefox, Internet Explorer or Opera

×
Community
General discussionBeware! - Rayman Forever from GOG contains infected files!(135 posts)(135 posts)
(135 posts)
Pages:
1
2
3
4
5
6
7
8
9
This is my favourite topic
Posted January 27, 2015
low rated
avatar
Lord_Kane: I think most of you really jumped over a cliff on this one,

The guy is doing just a service by warning us of a potential issue, he isnt doing it to attack GOG, he is bringing it to GOG's attention ffs.

and since he does working the computer security field, yeah I would be suspicious too, especially if this reflects how I do the job.

KamamuraL I suggest filing a ticket with GOG support as its more mainline into GOG then the forum tends to be, and they are quite helpful, may take a bit of time to respond though, I would also provide all the documentation and proof you have so far collected as I am sure it will help them track down the issue and resolve it.

Sorry you got shit on by people here.
avatar
tinyE: You did read the entire thread didn't you? :P Yeah there is a little piling on here and that is embarrassing, but the vast majority of the people who initially took to this thread attempted to help the OP and were basically told to stick it up their asses. XD Does that give anyone the right to act the way some of us (myself included) acted? No, and I apologize for that, but it was clear from the tone and the replies from the OP that he came in here asking for help with no actual desire to receive any.
Yes, Infact I did read the entire thread, and yeah I do agree there was piling on and he did react wrong and as you admitted so did you and maybe he was looking for someone from the GOG staff to go "okay there seems to be a problem, let us have a look at it." which you know is fair, you buy something from this site and they should be aware of potential problems like this, but going "he wasnt looking for help" is a bit.....silly in my opinion.
Posted January 27, 2015
I don't blame the OP for being suspicious of a file that leads to alerts on a few AV scanners. Monday I got an email supposedly from a vendor of mine, with a zip attached labeled as a fax document. That's a red flag to me since most places simply attach a PDF directly - any decent enterprise MFD will create PDFs and not bother with zipping it. So I threw the file at virustotal.com. Yesterday it came up with 3 alerts out of 57 scanners. Yeah, but... looking closely, the icon is a faked version of the default PDF icon and I wasn't going to open it regardless. Out of curiosity from reading updates to this thread, I just scanned again 5 minutes ago: 30 alerts out of 57.

What a difference a day makes. Glad I didn't look at that initial 5% hit rate and decide that it was okay to open the file - as a few people in the thread said it should be okay to do since it was only 3 or 4 out of 57.

One alert is enough to cause some suspicion, and at least the OP took the steps to double-check directly with those providers popping the alerts. And posted the results for us.
Posted January 27, 2015
avatar
HereForTheBeer: - as a few people in the thread said it should be okay to do since it was only 3 or 4 out of 57.
A small correction here. 4 out of 56 for a file first scanned today is not a reason to dismiss it. 4 out of 56 for a file first scanned two months ago is reason to dismiss it.
Just like you said, one day makes a big difference. So if reputable antivirus systems don't find anything wrong after a few weeks of a file being out in the wild, either the antivirus systems are not reputable, or the file isn't out in the wild.
And checking the malware identified, it does appear to be a false positive.
Posted January 27, 2015
avatar
HereForTheBeer: - as a few people in the thread said it should be okay to do since it was only 3 or 4 out of 57.
avatar
JMich: A small correction here. 4 out of 56 for a file first scanned today is not a reason to dismiss it. 4 out of 56 for a file first scanned two months ago is reason to dismiss it.
Just like you said, one day makes a big difference. So if reputable antivirus systems don't find anything wrong after a few weeks of a file being out in the wild, either the antivirus systems are not reputable, or the file isn't out in the wild.
And checking the malware identified, it does appear to be a false positive.
An additional small correction here: it wasn't first scanned two months ago, but rather several years ago. The false positive has been known about since forever (pun intended), as the fourth post in this thread so amply demonstrated.
Posted January 27, 2015
avatar
HereForTheBeer: - as a few people in the thread said it should be okay to do since it was only 3 or 4 out of 57.
avatar
JMich: A small correction here. 4 out of 56 for a file first scanned today is not a reason to dismiss it. 4 out of 56 for a file first scanned two months ago is reason to dismiss it.
Just like you said, one day makes a big difference. So if reputable antivirus systems don't find anything wrong after a few weeks of a file being out in the wild, either the antivirus systems are not reputable, or the file isn't out in the wild.
And checking the malware identified, it does appear to be a false positive.
Point taken, though when one is paid to be paranoid about these things...

Anywho, the discussion provided some good info though the tone took a turn for the worse. I'll give the entire thing a + because it did teach me a few things.
Posted January 27, 2015
avatar
HereForTheBeer: Point taken, though when one is paid to be paranoid about these things...
Actually, the big bucks are not paid to be paranoid, but to be able to tell what's wrong fast.
Imagine this scenario, I call you to report one of my machines has a warning light on. You tell me that the specific light is to warn of overheating, but the connector is known to be faulty. Do you immediately tell me I have to shut down production until you can come here to check it, or do you try to verify if it's a false positive so I can continue working until you get here?

And which of the two responses is the one that gets the big bucks (assuming it's correct of course)?
Posted January 27, 2015
avatar
HereForTheBeer: Point taken, though when one is paid to be paranoid about these things...
avatar
JMich: Actually, the big bucks are not paid to be paranoid, but to be able to tell what's wrong fast.
Imagine this scenario, I call you to report one of my machines has a warning light on. You tell me that the specific light is to warn of overheating, but the connector is known to be faulty. Do you immediately tell me I have to shut down production until you can come here to check it, or do you try to verify if it's a false positive so I can continue working until you get here?

And which of the two responses is the one that gets the big bucks (assuming it's correct of course)?
One can be both paranoid and efficient. And when talking a leisure activity like gaming, the professional paranoid has the luxury of time. "While they check out my submitted file, I'll play something else." Something like that.

And how would I know about machines? ; ) But it depends on the problem. If you're talking something like the safety circuits and I know the customer is not capable of troubleshooting even with my remote help, then I may very well suggest that they stop until I arrive. Situational thing.
Posted January 27, 2015
avatar
HereForTheBeer: And how would I know about machines? ; )
You are the guy that drives around the US fixing big pieces of machinery, right? Or have I mixed you with someone else?
And yes, a healthy amount of paranoia is good, but the trick is to know what that amount is. Quarantine the file, double check the file, but don't start scrubbing before the results come in.
Posted January 27, 2015
avatar
HereForTheBeer: And how would I know about machines? ; )
avatar
JMich: You are the guy that drives around the US fixing big pieces of machinery, right?
Hey, don't discount his work.
Posted January 27, 2015
avatar
JMich: You are the guy that drives around the US fixing big pieces of machinery, right?
avatar
tinyE: Hey, don't discount his work.
I gave him my 30-30 extended guarantee: 30 minutes or 30 miles.
Posted January 28, 2015
low rated
You are not ignorant because someone calls you ignorant. You are ignorant because your actions are based on lack of knowledge, specifically in this case, you install and run binaries from questionable sources based on assurance of a marketing guy that "they are okay", despite your antivirus software you use (why exactly, if you ignore its warnings?) says otherwise. If there was a textbook definition of ignorance, this example could be used on the spot.

To other peasants spewing insults and general filth - just because you bunch up and reassure each other does not mean you are right. On the other hand, mob mentality is characteristic for rabble of all kinds. Please, grow up. Cultivate your minds. Your parents would be sad seeing you acting like this.
Post edited January 28, 2015 by Kamamura
Posted January 28, 2015
Well lets consider this option - Gog's binaries DON'T CONTAIN ANYTHING suspicious BUT some malware created long after those originally Dos Only, have used some pieces of code, that SOME new Antivirus Software consider similar enough to those present in these OLD binaries. As these fragments ARE similar the Antivirus Software can't declare the fragments aren't there, but it can't check for sure what these intact do in the game either - OR THEY JUST DON'T CARE TO DO SO ON A LONG FORGOTTEN (by them at least) game with no Online capabilities (SO IT CAN'T SPREAD THESE in the wild).

This is only one option - the other being Gog actually did reverse engineer the binaries and added some code that will allow them to run as good as possible on newer systems, and that code, while not malware oriented does exhibit behaviors these Antivirus Software find suspicious - again, not by itself, but by pure coincidence to actual malware appearing in the wild.

Suppose one of these options are the correct one, what will you expect to justify dropping the issue and moving on with your life?
Posted January 28, 2015
avatar
BlackThorny: Well lets consider this option - Gog's binaries DON'T CONTAIN ANYTHING suspicious BUT some malware created long after those originally Dos Only, have used some pieces of code, that SOME new Antivirus Software consider similar enough to those present in these OLD binaries. As these fragments ARE similar the Antivirus Software can't declare the fragments aren't there, but it can't check for sure what these intact do in the game either - OR THEY JUST DON'T CARE TO DO SO ON A LONG FORGOTTEN (by them at least) game with no Online capabilities (SO IT CAN'T SPREAD THESE in the wild).

This is only one option - the other being Gog actually did reverse engineer the binaries and added some code that will allow them to run as good as possible on newer systems, and that code, while not malware oriented does exhibit behaviors these Antivirus Software find suspicious - again, not by itself, but by pure coincidence to actual malware appearing in the wild.

Suppose one of these options are the correct one, what will you expect to justify dropping the issue and moving on with your life?
He just called us peasants. I think that tells us all we need to know. XD
Posted January 28, 2015
avatar
BlackThorny: snip
avatar
tinyE: He just called us peasants. I think that tells us all we need to know. XD
Actually I think he called "you" peasants :P Anyway I'm genuinely curious to what level he is committed to this non issue (or non issues in general)
Posted January 28, 2015
avatar
Kamamura: You are not ignorant because someone calls you ignorant. You are ignorant because your actions are based on lack of knowledge, specifically in this case, you install and run binaries from questionable sources based on assurance of a marketing guy that "they are okay", despite your antivirus software you use (why exactly, if you ignore its warnings?) says otherwise. If there was a textbook definition of ignorance, this example could be used on the spot.

To other peasants spewing insults and general filth - just because you bunch up and reassure each other does not mean you are right. On the other hand, mob mentality is characteristic for rabble of all kinds. Please, grow up. Cultivate your minds. Your parents would be sad seeing you acting like this.
Who the hell are you talking to? The quote system exists for a reason.

And the Rayman Forever "virus" was confirmed to be a false positive more than three years ago. You have been told this, with links to relevant threads, yet you still go on about it, and you dare speak of ignorance?
Pages:
1
2
3
4
5
6
7
8
9
This is my favourite topic
Community
General discussionBeware! - Rayman Forever from GOG contains infected files!(135 posts)(135 posts)
(135 posts)