ID:718518
 
Keywords: avg, false, positive
Descriptive Problem Summary:
Recently, AVG will randomly decide to throw out this upon joining a game using 494:

virus

Numbered Steps to Reproduce Problem:
1. Have AVG as your anti-virus.
2. Join a game and hope it shows up? It's very sporadic about doing it.

Expected Results:
AVG doesn't freak out.

Actual Results:
AVG tries to quarantine DreamSeeker.exe for unknown reasons.

Does the problem occur:
Every time? Or how often? Very randomly.
In other games? Seems to affect any game.
In other user accounts? Untested.
On other computers? A friend of mine said this happened to him earlier. He's on Windows 7 Professional 64-bit.

When does the problem NOT occur?
Hard to say. It's a very rare occurrence.

Did the problem NOT occur in any earlier versions? If so, what was the last version that worked?
This has only started showing up in the recent versions of 494.

Workarounds:
Allowing it to continue lets DreamSeeker continue about its business, and I've yet to see any repercussions of letting it do so.
have you tried submitting it for AVG to look into? that's the only option you have and that would help this issue...

Or you could have a virus attaching itself to dreakseeker! oh noes! - https://www.virustotal.com/ - upload here and see what it says..

I believe you have the option to submit the files with most* anti virus systems...
In response to A.T.H.K
Uploaded my DreamSeeker.exe from that location to that site, says this.
Very strange it must be when something from the server is coming into the program ...

I would still submit it to AVG may just be a false positive they will fix it just don't ask how long :P
It will be to do with the way certain games communicate with the user and what sort of traffic they're sending, I imagine. Just some suspicious behaviour on behalf of a BYOND game triggering AVG to throw up a false positive.
This isn't a bug; it's not something we control, but a problem with AVG. It needs to be resolved at their end.

Although personally, I stopped using AVG some time ago. When they moved to version 8.0 the whole program became massively unstable, to the point where their updates started failing and their driver would block all Internet access after a reboot.
In response to Lummox JR
Lummox JR wrote:
This isn't a bug; it's not something we control, but a problem with AVG. It needs to be resolved at their end.

Although personally, I stopped using AVG some time ago. When they moved to version 8.0 the whole program became massively unstable, to the point where their updates started failing and their driver would block all Internet access after a reboot.

Is there any free anti-virus program you would recommend using?
AVAST is what I use, seems pretty good from my experience and hasn't caused me much trouble or hassle getting programs to run.
I would try Panda Cloud it's free fast and great.
If your not completely opposed to microsoft programs, I've been pretty happy with Microsoft security essentials. No constant "Upgrade now!" ads, surprisingly doesn't conflict with anything, doesn't bog down my computer, and catches viruses.
I've had the same thing happen to me recently as well

the reason for AVG blocking and removing Dreamseeker is cause this site and the games on here made that need Dreamseeker to run them are all 3rd party programs and aren't official at all and all have no security for them so every time you access Dreamseeker to play a game on here mainly if it needs online access to your internet signal its very easy to have a virus slip by during it, like I said this site has no security for any of this cause its all 3rd party unofficial etc
In response to VayuPurana
The software is quite secure--you're way more apt to get malware from a rogue site than from someone figuring out an exploit in a hub entry, and if we found that happening we'd quickly ban the person responsible. You're quite incorrect about BYOND having "no security".

Frankly the problem with AVG throwing false positives is not a new one. Any program out there is likely to run into false positives from various antivirus programs from time to time, and AVG has had this issue more than once. As I mentioned earlier in this thread, AVG is no longer considered a good antivirus program by any standard.
I've since taken Higoten's suggestion and switched to Microsoft Security Essentials. I find it a lot better and less resource intensive than AVG, and it hasn't given me any dumb false positives over things!
In response to Lummox JR
Lummox JR wrote:
As I mentioned earlier in this thread, AVG is no longer considered a good antivirus program by any standard.

Personally I never considered AVG being good. For me it's somewhere in the bottom of the list.

I haven't used antivirus for a long time and got no viruses, can't bother with constant slowdown caused by AVs. It's quite hard to catch virus if you use common sense.
are all 3rd party programs and aren't official at all

All programs are third-party, in that neither you nor the antivirus software manufacturer made them. I'm not really sure what you mean by 'not official' - not made by Microsoft, or not personally endorsed by AVG? Sure. BYOND is a formal company though, I'm sure you can find them on whatever the American equivalent of Companys House is.

It's far more likely that AVG did what AVAST recently did for a while, and flagged BYOND as potentially suspicious because it's got a high volume of internet traffic and isn't a well-known program - the AVAST message actually explained something to this effect. ( Network traffic, low notoriety. )
i used the website virustotal.com and it seems that it indeed found a virus (or at least something) there is no "Warning: There is a virus on the file" message but to what i can understand the website says that there is. Please correct me if i am wrong, i scanned it right after my AVG antivirus gave me the warning when i joined a game (second time it happens and the coincidence is that both times were when i finished downloading games that are developed by known hackers.)

Here is the link:
https://www.virustotal.com/file/ a1eb6d72e1e4639424d2f3dc5f06d355911d02ad952868d4ad17fd4a3d4/ analysis/
Ahh, yes. The confusing and strange world of anti-virus scanning and Virus.Naming.Methods.
TL;DR: It's safe.

Now the explanation:

PUA.Win32.Packer.MasmTasm-2

PUA means 'Potentially Unwanted Application.' This means that whilst a file isn't a virus, or malicious, it may behave in a way the user does not expect.

Win32: it's a 32-bit Windows application.

Packer means that the installation executable uses a runtime packer. This basically reduces the size of the files you need to download, without needing another tool to unpack them. Think of it as an archive that can unzip itself.
The reason this is flagged is that viruses or malware often use this method to make themselves less noticable.

MASM and TASM are 32-bit assemblers, I believe. So this will, I assume, be the way the BYOND installer was assembled/compiled. All fits pretty neatly together;

The file isn't malicious, it's just bundled in a way that files which ARE malicious are often bundled; It's a 'Potentially unwanted application, on 32-bit Windows architecture. Considered suspicious because it used a runtime packer. Also, it was assembled using MASM/TASM.'

The other specific message I've seen is about non-proliferation of dreamseeker.exe or BYOND.exe. This seems to be because they're not widely recognised or profiled by antivirus engines, so it will err on the side of caution and flag the network traffic generated by games ( and constant communication with the pager/hubs ) as suspicious.
In response to Deathguard
Thank you for your explanation.
I have another question though, why would my antivirus only warn me that it is "malicious" only when i joined those two specific games i mentioned above? not when i installed byond, nor when i join any other byond games.
Well first off, which games and who are these 'known hackers?' That seems to be a title a great number of people on BYOND are willing to claim, and a great number of mislead or uninformed people are willing to attribute to someone. It's very rarely the case.

If you can answer those two questions I'll hazard a guess for you.
In response to Deathguard
Of curse, i use the term hack although what they have done (that I've witnessed) are simple abuses on old codes on a Naruto GOA rip. Also the second time it happened was on a Bleach las noches rip. On the goa one he is not the owner of it but it never happened on that game (which I've played a few times) until he was hired to work on it. It's too much of a coincidence to me..
Page: 1 2