User Tag List

Page 1 of 2 1 2 LastLast
Results 1 to 10 of 19

Thread: Game detected as a virus

  1. #1
    No Products Registered

    Join Date
    Feb 2011
    Posts
    8
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)

    Game detected as a virus

    My son created a game for a 5th grade project at school. The game will be distributed to kids at his school. We tested the game several times on various computers with no problems. However I recently renewed Norton on one of the computers and installed Norton 2011. Norton SONAR now detects the game as a virus when it is played from a CD-ROM. If the program is stored on the harddrive SONAR doesn't have a problem with the program. I have submitted the program to Norton to try and have the game "white listed" as was described in other threads on this board. But I'm afraid they won't fix the issue before my son's project due date, around March 14th.

    Besides going through Norton, is there anything we can do in terms of altering the progam as a work around?

  2. #2
    Clickteam Clickteam

    Join Date
    Jun 2006
    Location
    France
    Posts
    13,958
    Mentioned
    277 Post(s)
    Tagged
    3 Thread(s)

    Re: Game detected as a virus

    I've answered in the other thread, but yes there is a solution : uncheck the "Compress the runtime" option in the properties of the application and rebuild it, it won't generate a false positive anymore.

  3. #3
    No Products Registered

    Join Date
    Feb 2011
    Posts
    8
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)

    Re: Game detected as a virus

    Thanks for your quick replies Yves.

    I re-built the game with "Compress the runtime" unchecked and that did not solve the problem.

    I had a theory that the problem may be related to the fact that the game is keeping track of the hi-score, so I deleted that frame and rebuilt. Unfortunately the problem still persists.

  4. #4
    Clickteam Clickteam

    Join Date
    Jun 2006
    Location
    France
    Posts
    13,958
    Mentioned
    277 Post(s)
    Tagged
    3 Thread(s)

    Re: Game detected as a virus

    Have you tried with the build 251? There could be differences between this build and the build 239 you tried previously.

  5. #5
    No Products Registered

    Join Date
    Feb 2011
    Posts
    8
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)

    Re: Game detected as a virus

    Yes, I first updated to build 251.

  6. #6
    Clickteam Clickteam

    Join Date
    Jun 2006
    Location
    France
    Posts
    13,958
    Mentioned
    277 Post(s)
    Tagged
    3 Thread(s)

    Re: Game detected as a virus

    Hmm... I don't know what is causing this issue in the runtime, what does Sonar detect as possible problem, there is nothing suspicious in the runtime...

    I'm going to make a few changes and I'll send you an update so that you can test.

  7. #7
    No Products Registered

    Join Date
    Feb 2011
    Posts
    8
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)

    Re: Game detected as a virus

    Here is what the Norton quarantine log says:


    The first entry is for SAV6.EXE a the version where I eliminated the high score screen & compress box unchecked. The second entry is for SAV4.EXE, the same version as the original program but with the compress box unchecked.


    Full Path: Not Available
    ____________________________
    ____________________________
    On computers as of:
    2/26/2011 at 11:05:10 AM
    Last Used:
    2/26/2011 at 11:19:26 AM
    Startup Item:
    No
    Launched:
    Yes
    ____________________________
    ____________________________
    Very Few Users
    Fewer than 5 users in the Norton Community have used this file.
    ____________________________
    High
    This file risk is high.
    ____________________________
    Threat Details
    SONAR Protection monitors for suspicious program activity on your computer.
    ____________________________
    Origin
    Downloaded from URL Not Available

    Source File:
    sav6.exe
    ____________________________
    File Actions
    File: e:\sav6.exe
    Remove failed - write protected volume
    ____________________________
    Registry Actions
    Registry change: HKEY_USERS\S-1-5-21-776561741-583907252-1801674531-1004\Software\Microsoft\Windows\CurrentVersion\Exp lorer\MountPoints2\{edf0e02e-becf-11de-9526-806d6172696f}
    Delete Failed
    ____________________________
    File Thumbprint - SHA:
    Not Available
    ____________________________
    File Thumbprint - MD5:
    Not Available
    ____________________________



    ==================================
    Here is the log entry for SAV4.EXE
    ==================================




    Full Path: Not Available
    ____________________________
    ____________________________
    On computers as of:
    2/26/2011 at 10:32:23 AM
    Last Used:
    2/26/2011 at 12:25:44 PM
    Startup Item:
    No
    Launched:
    Yes
    ____________________________
    ____________________________
    Very Few Users
    Fewer than 5 users in the Norton Community have used this file.
    ____________________________
    High
    This file risk is high.
    ____________________________
    Threat Details
    SONAR Protection monitors for suspicious program activity on your computer.
    ____________________________
    Origin
    Downloaded from URL Not Available

    Source File:
    sav4.exe
    ____________________________
    File Actions
    File: e:\SAV4.exe
    Remove failed - write protected volume
    ____________________________
    Registry Actions
    Registry change: HKEY_USERS\S-1-5-21-776561741-583907252-1801674531-1004\Software\Microsoft\Windows\CurrentVersion\Exp lorer\MountPoints2\{edf0e02e-becf-11de-9526-806d6172696f}
    Delete Failed
    ____________________________
    File Thumbprint - SHA:
    Not Available
    ____________________________
    File Thumbprint - MD5:
    Not Available
    ____________________________



  8. #8
    Clickteam Clickteam

    Join Date
    Jun 2006
    Location
    France
    Posts
    13,958
    Mentioned
    277 Post(s)
    Tagged
    3 Thread(s)

    Re: Game detected as a virus

    Not tons of info in "This file risk is high".

    The actions at the bottom are Sonar actions to delete the file and disable the auto-run.

    I've sent you new runtime files by PM. Let me know if that fixes it!

  9. #9
    No Products Registered

    Join Date
    Feb 2011
    Posts
    8
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)

    Re: Game detected as a virus

    Hi Yves,

    Well...I installed the new runtime files and got the same results. Both with and without the "compress the runtime" box checked. Even though they are probably not helpful, I'll send you the Norton logs on them anyway (SAV7.EXE is with compress off and SAV8.EXE is with compress on).


    Since I have been able to go undetected by SONAR by copying the game over the nework and playing it directly from the harddrive, I had MMF2 build an installer. Well, the installer is also flagged by SONAR. Note that I reinstalled MMF2 with the original runtimefiles and the latest update. Attached is the Norton log on that false positive.

    It is interesting that none of the attached Norton logs have anything about the registry as they did my previous email.

    The problem version of Norton 2011 is 18.5.0.125

    What do you think we should try next?



    -Doug




    =========
    SAV7.EXE
    =========

    Full Path: Not Available
    ____________________________
    ____________________________
    On computers as of:
    2/26/2011 at 3:42:45 PM
    Last Used:
    2/26/2011 at 4:11:14 PM
    Startup Item:
    No
    Launched:
    Yes
    ____________________________
    ____________________________
    Very Few Users
    Fewer than 5 users in the Norton Community have used this file.
    ____________________________
    High
    This file risk is high.
    ____________________________
    Threat Details
    SONAR Protection monitors for suspicious program activity on your computer.
    ____________________________
    Origin
    Downloaded from URL Not Available

    Source File:
    sav7.exe
    ____________________________
    File Actions
    File: e:\sav7.exe
    Remove failed - write protected volume
    ____________________________
    File Thumbprint - SHA:
    Not Available
    ____________________________
    File Thumbprint - MD5:
    Not Available
    ____________________________






    =========
    SAV8.EXE
    =========

    Full Path: Not Available
    ____________________________
    ____________________________
    On computers as of:
    2/26/2011 at 3:43:32 PM
    Last Used:
    2/26/2011 at 4:57:48 PM
    Startup Item:
    No
    Launched:
    Yes
    ____________________________
    ____________________________
    Very Few Users
    Fewer than 5 users in the Norton Community have used this file.
    ____________________________
    High
    This file risk is high.
    ____________________________
    Threat Details
    SONAR Protection monitors for suspicious program activity on your computer.
    ____________________________
    Origin
    Downloaded from URL Not Available

    Source File:
    sav8.exe
    ____________________________
    File Actions
    File: e:\sav8.exe
    Remove failed - write protected volume
    ____________________________
    File Thumbprint - SHA:
    Not Available
    ____________________________
    File Thumbprint - MD5:
    Not Available
    ____________________________



    ================
    InstallSAV4.EXE
    ================

    Full Path: Not Available
    ____________________________
    ____________________________
    On computers as of:
    2/27/2011 at 12:27:45 PM
    Last Used:
    2/27/2011 at 12:36:42 PM
    Startup Item:
    No
    Launched:
    Yes
    ____________________________
    ____________________________
    Very Few Users
    Fewer than 5 users in the Norton Community have used this file.
    ____________________________
    High
    This file risk is high.
    ____________________________
    Threat Details
    SONAR Protection monitors for suspicious program activity on your computer.
    ____________________________
    Origin
    Downloaded from URL Not Available

    Source File:
    installsav4.exe
    ____________________________
    File Actions
    File: d:\installsav4.exe
    Remove failed - write protected volume
    ____________________________
    File Thumbprint - SHA:
    Not Available
    ____________________________
    File Thumbprint - MD5:
    Not Available
    ____________________________



  10. #10
    Clickteam Clickteam

    Join Date
    Jun 2006
    Location
    France
    Posts
    13,958
    Mentioned
    277 Post(s)
    Tagged
    3 Thread(s)

    Re: Game detected as a virus

    Hmm... I don't see what else we can do. Can you submit all these files to Symantec?

    Both programs (runtime and installer) extract executable files to the temp folder, perhaps that's what Sonar doesn't like... I don't see why it would trigger the alert only when they are executed from the CD-ROM though, that's a mystery. But that would explain why only a couple of Norton users have reported the problem.

    I'll try to find other ideas next week. I'll also probably get Norton 2011 to see if I can find what they don't like.

Page 1 of 2 1 2 LastLast

Similar Threads

  1. INST.$$A detected as virus by McAfee!?
    By DoMi in forum Multimedia Fusion 2 - Technical Support
    Replies: 15
    Last Post: 7th October 2010, 04:45 AM
  2. AVG says threat detected
    By Tuna in forum Multimedia Fusion 2 - Technical Support
    Replies: 10
    Last Post: 24th August 2010, 07:23 PM
  3. Severe Bug Detected
    By Ganryu in forum dotNet Scripting
    Replies: 1
    Last Post: 26th January 2009, 09:01 PM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •