Coin Stealer Malware Infection - Technischer Support

#1 Eingetragen von Fyrosfreddy vor 8 Jahren [en]

Got this popup on this morning's scan:

Been thru this before w/ KC where it turned out to be a false positive; my guess is you will want to resolve this one way or another.

http://imgur.com/P3T3iuX

6 mal geändert | Zuletzt geändert von Fyrosfreddy (vor 8 Jahren)

---

#2 Eingetragen von Fyrosfreddy vor 8 Jahren [en]

{translate}

Any progress here ?

When this happened with a Ryzom related 3rd party tool, we were able to get it fixed so it would mistakenly report the false positive as a virus.

But as I am not officially affiliated with Ryzom, I', not going to get them to put in much effort on my account w/o any "official contact"

---

#3 Eingetragen von Fyrosfreddy vor 8 Jahren [en]

{translate}

Seems latest patch eliminated the problem.

---

#4 Eingetragen von Fyrosfreddy vor 8 Jahren [en]

{translate}

It's baaaaaack

The new "This is not a patchnote" patch is flagging it again .... All Kapersky will tell me is that until they here from developer, they ain't gonna do squat.

Does TS monitor this section ?

---

#5 Eingetragen von Placio vor 8 Jahren [en]

{translate}

I assume that they don't or at least not every 2 weeks. Emailing support@ryzom.com seems like a more reliable way to get this issue to the devs.

Zuletzt geändert von Placio (vor 8 Jahren)

#6 Eingetragen von Fyrosfreddy vor 8 Jahren [en]

{translate}

Did that too ... But if it's not monitored, perhaps it should be closed.

---

#7 Eingetragen von Mjollren vor 8 Jahren [en]

{translate}

Personally I would flag Kaspersky as idiots after several problems with the same game, but that's just me. You'd think they would learn what pattern in the game executable triggers their routines, analyze it, and whitelist it.

---

#8 Eingetragen von Placio vor 8 Jahren [en]

{translate}

But but, if your antivirus doesn't find new threat how can they be sure you will pay them more money???

#9 Eingetragen von Fyrosfreddy vor 8 Jahren [en]

{translate}

Mjollren

Personally I would flag Kaspersky as idiots after several problems with the same game, but that's just me. You'd think they would learn what pattern in the game executable triggers their routines, analyze it, and whitelist it.

That's not how the industry works. First think about how many programs and apps exist on Windows, Linux, Mac, IOS, Android etc . Then think about the fact the Ryzom has about 500 users. It's not their job to seek out and test ever obscure application that exists .... if a false posituive occurs, it needs to be reported by the author and action will be taken. This happened with Kipeecraft and was addressed in a relatively short time.

Second this every time the code is changed as in a "patch" the whitelisted file is now a new file.... so the pacthed file is not on the white list. If version 2.887 of a file is 16,653 KB and the patched file is 16,654 it won't be white listed

How do we know that the file isn't infected or shows segment of code that is part of the serrch algorithym ?

I worked as a CSi Wizop for Time Waner and WUGNET for many years , we had to clear all submitted files / spplicatiosn befoe they would be placed in on-line libraries. Every file had to be cleared before the file could be accessed by the public and was scanned with multiple utilities. If it was flagged as infected, the author was notified, the author contacted the vendor and cause determined. A solution was available in a matter of days, soemtimes witha change in code, spometime with a chnage in AV database.

---