trojan reported by kaspersky

lol almost died laughing

Yesterday i make decision to reinstall whole thing and this took me more than 3 hours...lol why?Because my CiS (Commodo internet security eat half off CF files)This happen first time, ok i uninstalled all and u know the procedure, but before i do that just for checking purpose i make all CF files as trusted (all files which CIS quarantined in one way or another just to give CiS a second chance lol) Guess what happened?
Third time i disabled all levels of protection and ofc CF was installed with zero issues.

What i want to say is>Problem does not lie in CF nor in our anti virus, anti trojan or firewall software.Problem is:We do not know hot to use them properly in most of the cases...lol

greetings

So , can anyone explain me , why Kaspersky detecting healing.dll as trojan ?

because Kasperski is rubbish AV that relies on heuristic scans instead of real scans

Quote from SWAT_OP-R8R

because Kasperski is rubbish AV that relies on heuristic scans instead of real scans

Thanks. I'm always know , kaspersky is rubbish .

I am thinking to release my own Antivirus, that will randomly quarantine .dlls and ask for your
credit card to stop spaming alerts.

How does that sound?

Weee!! I am gonna get rich!

http://www.virustotal.com/file…d1a7dae653fd01-1300136215

8/41

8 AVs... all use heuristic scans and report 5 different variations
most important on that link is that none of the big commercial AVs that rely on real scans and large databases give any reports

these heuristic scans can even detect fresh windows installs as virus

i have adviced kaspersky that he have to ignore the healing.dll ... no problems to start
but i start single player and have the huge problem that i have "meet Jun'ke at the Equipment Dealer" and no Jun'ke is there ...

and in which file are the Mission Descriptions ? ( i will look if i can restore for some of the standart quests the german text)

funny is that in the first baarkeeper Dialoge: they talk a mix between english and german audio
sorry for my english

by the way the crossfire mod is the reason that i search my freelancer CD
i think a great project i have love the game

The reason it is they detect it as a virus is because healing.dll calls server.dll and that is the string the AV think suspicious, plus it reads protected memory, the combo is the cause.

IF Server.dll was called something else and healing.dll referenced it, I doubt the AVs would find it.... but I am unsure of how many of your dll/exe reference it... so I pass the ball back to your side... heh

like i said, this prob will be fixed with the next cf version

I would have liked to try this mod but my anti virus also flagged the download as a virus and deleted part of it. I like many others simply cant download another 1.5gigs of data as our quotas wont allow it (3gb for one game is a lot) Things like this would be so easy if there was a torrent to download as we would only have to recheck the file and only the deleted part would have had to be downloaded again.

You say its been fixed but who knows if this would be able to happen again in future, meh the mod looked good anyway (trundles off to play disco)

things would be so complicated if there would be a torrent as i could not guarantee that the files are free of virusses then

Quote from SWAT_OP-R8R

things would be so complicated if there would be a torrent as i could not guarantee that the files are free of virusses then

You might be right, but the ownus would be on the end user to check for viruses? 90% of the problems I think your getting at could be verified with a MD5 hash check anyway (As long as you are able to guarantee the hash at your end)

maybe, maybe not
CF is offered to download at 2 places - SWAT and ModDB
on exactly those 2 places I am able to guarantee that the mod is free from malicious software
torrents can be infected at any time and md5 codes can be wrong

i simply prefer the current way of publishing it