OB Client has a virus?!

[Wandering Youth]

I'm one of the few who bothered to download the OB client just for the heck of it even if I couldn't play it...yet.

I found something interesting when I finished downloading the OB client from NCSoft's Aion site using Neffy. I tried to installed the game but my anti-virus immediately detected a virus within the downloaded files.

Anyone else getting this?

Below are some pictures.

[lyankyj]

I know someone who got alerted by his anti-virus software on one of the .bin files...that was false alarm.

[zeeZ]

One of the closed betas (2?) had ncvoicechat.dll alerted by most anti-virus. You can either trust the source of your application and ignore it as a false positive or refuse to touch it until you've got a more official statement... Or wait till it's our turn to play the game like we're supposed to :P

[Yakuzan]

The application has some files that require to access or change some files in system32, these files usually don't ask your permission so they "kind of" act like a virus but they're goal isn't too break something y'know


P.S Happened to me in Lineage2 when a few files were changing local server settings of my windows files so my Kaspersky anti-virus kept alerting me it was a virus but after doing a few tests the L2 files were changing parameters in local host files so no biggie.

[Kyrein]

Why is it called system32 anyway?

[Riboswitchh]

ask google

[Stubbsy]

Yeah you're using Avast. Turns up alot of false positives.

Although, I use it too its a great AV, i'd rather have false positives to be safe than it not detect anything and end up being virus-riddled :P

But yeah, if you know somethings from a trusted location it's usually an FP.

[Dominator]

I haven't used anti-vir prog for 4 years now...they are the one who infect you.

[gguus]

Originally Posted by Ovum

I haven't used anti-vir prog for 4 years now...they are the one who infect you.

lol 567890

[DeiF]

GameGuard can be considered a virus.

From Wikipedia:

Because of its method of actuation (very similar to a rootkit), it is criticized for being extremely invasive, often without knowledge of the end user. The software installs a device driver which is difficult to uninstall; even uninstalling the game will still leave some files hidden on the system, but it stays inactive without the game. In recent versions (revision 1007 and up), GameGuard fails to halt when the game ends, so GameGuard continues to use computer resources and inject code into processes. This is often unknown to the end-user, as GameGuard masks its CPU usage by hooking Windows system querying APIs. Most anti-virus vendors currently exclude nProtect GameGuard from their detection databases due to it being commercial software, however this was initially not the case, leading to system crashes as both the Antivirus and GameGuard attempted to override each other.

GG and some antivirus software try to take control of your OS (like a virus), often causing crashes and more headaches than they are worth, so thay can see each other as a virus (specially with older versions).
But looking at your screenshots it seems that the AV software is not detecting a specific virus, but rather is using heuristics and has detected "something" that could be a virus (Win32.Trojan-gen{Other}) so I shouldn't worry.
There are dozens of online antivirus programs that you can use to be sure.

[Riku]

I don't have Avast so I can't help you with that one, Im using Threatfire because its not a resource hog.

[Celestin]

Person from CA, just wait your turn. /sage nod

It's not that we didn't bother to download the client, it's because we are being good boys and girls and biding our time.

I haven't updated my AVG in about... 6 months. I just updated today and finished my system scan. In those 6 months, I acquired ZERO viruses, ZERO trojans, ZERO spywares. A bunch of tracking cookies though. So, with that said, just use common sense. NCSoft is not going to give you a virus just because they can. Maybe a rootkit. But not a virus. That would be unethical ( a rootkit is perfectly ethical ).

[kitsunegirl]

Avast I think it the worst antivirus program in existence, right next to mccaffee and norton. You cant terminate the program, or atleast I was never able to. No matter what, it turns on and its on until you delete the program. AVG is a much better program (from Grisoft), you can turn it off if you need to with ctrl alt del, but you have to terminate like 4 processes to make it really stop.

However since I rarely get viruses, Im considering uninstalling it, freeing up some usage.

[Fasimedes]

Good work avast!
Since thats not a false alarm. I'v checked my copy with positive result. Indeed, one of the resource files got virus starter script inside it (a file named folder.htt). But be sure that file is NOT dangerous for players, because: a) normally it will never pop out of resource file; b) Virus executable body is not present inside the client at all, so infection is not possible.
Anyway NCsoft needs to run antivirus check in their PC's and repack affected file with a safe one.

If some of our Korean friends is ready to provide a report to NCsoft on this issue, i will supply one with full technical info.

[adrianus]

Originally Posted by Yakuzan

The application has some files that require to access or change some files in system32, these files usually don't ask your permission so they "kind of" act like a virus but they're goal isn't too break something y'know


P.S Happened to me in Lineage2 when a few files were changing local server settings of my windows files so my Kaspersky anti-virus kept alerting me it was a virus but after doing a few tests the L2 files were changing parameters in local host files so no biggie.

actually it is a trojan.. that means a program who interact with a server in order to exchange datas... involuntary.. or in this case voluntary . but yeah.. it isnt a bad trojan :P