Why are most the demo files available for download viruses?

General discussion about Defcon

Moderator: Defcon moderators

Deren
level0
Posts: 3
Joined: Tue Nov 28, 2006 7:39 pm

Why are most the demo files available for download viruses?

Postby Deren » Tue Nov 28, 2006 7:50 pm

First, I've purchased the game and love it, but something is seriously up and I needed to post about this and see if I'm the only one that's encountered this.

Here is what I've gone through

1) Most of the download files are about 400kb in size
a) I thought that maybe it would start a download manager or something so I ran it and an error message came up so...
b)I proceeded to download from the available torrent file - that got me the full demo - loved it bought it.

2) After downloading the first link and thinking it was bugged I attempted to delete the file. I was unable to.
a) It repeatedly told me that a file was making use of it and to close all related programs. I closed everything I could via the task manager, killing processes etc., I was still unable
b) I rebooted my computer - still unable to delete the file
c) I booted into safe mode - still unable to delete the file either as a full administrator or a power user in Safe mode.

3) I had not run a virus scan yet this week, I run them regularly, and decided that this was sufficiently odd that it warranted a virus scan
a) AVG Free 7.5 found a "Trojan Horse Generic2 JDK" in \Documents and Settings\UserName\Local Settings\temp\miunst_.exe
b) The virus scan deleted this file.
c) I am now able to delete the original problematic file (defcon-win32-v1.0.exe) and have done so.


Given how new this game is it seems odd that the demo links wouldn't work, and would in fact have this effect on my system. If it is NOT in fact a virus - I'd still like an explanation. I've been recommending this game to friends and now have to go tell them all to run virus scanners and purge the download from their system... not the best marketing campaign :\

Thanks again for creating a great game, but seriously what's going on?

- Deren

---
Edit
I'm talking about the links from
http://www.everybody-dies.com/downloads/index.html

All 3 Introversion Mirrors, the link with the graphic at the top seems fine, and the rapidshare mirror.
Last edited by Deren on Tue Nov 28, 2006 8:00 pm, edited 3 times in total.
alphager
level3
level3
Posts: 400
Joined: Fri Jul 28, 2006 1:36 pm
Location: Germany
Contact:

Postby alphager » Tue Nov 28, 2006 7:54 pm

which link are you talking about?
User avatar
Spacemonkey
level4
level4
Posts: 609
Joined: Thu Oct 05, 2006 1:31 am
Location: Auckland, New Zealand

Postby Spacemonkey » Tue Nov 28, 2006 8:42 pm

This is the first i've ever heard of this problem.

Sounds like you already had a virus on your system.
Deren
level0
Posts: 3
Joined: Tue Nov 28, 2006 7:39 pm

Postby Deren » Tue Nov 28, 2006 8:51 pm

I run regular virus scans - and that doesn't explain why after running this file I couldn't delete it till I purged a virus from my system. I'm well aware that correlation does not equal causation but this is .... just a little suspicious. Especially considering the widely divergent size of the demo files available on the mirrors.
User avatar
TheHappyFriar
level2
level2
Posts: 236
Joined: Sun Mar 05, 2006 7:59 pm
Location: upper left

Postby TheHappyFriar » Wed Nov 29, 2006 3:21 am

both fileplantes & filefront said a size of 58.5mb for the dowload. sure you got it off there & not a "questionable" site (IE tried to warez a copy?)

also, do all your anti-virus stuff in safemode.
Deren
level0
Posts: 3
Joined: Tue Nov 28, 2006 7:39 pm

Postby Deren » Wed Nov 29, 2006 9:45 pm

No I didn't try to download a pirated version of the game. I purchased the game.
Yes some of the links work fine, but three of them do not.

All three of these links are provided from: http://www.everybody-dies.com/downloads/index.html
IF these are as I contend, viruses, then they should be removed from Introversion's site as approved Mirror links - that's all I'm saying.

I even tried it again today - when I right click save as the links from the 'Introversion Mirrors' that are posted on the Defcon website I get 400b (4k) files (not the patch) rather than the full demo and these are the links, again originally sourced from the Introversion link I provided above.
http://89.200.136.7/defcon-win32-v1.0.exe
http://89.200.136.6/defcon-win32-v1.0.exe
http://download5.introversion.co.uk/def ... 2-v1.0.exe

I've redownloaded the files to prove my theory and see if I have a virus again after running one of these files. I will let you know the results shortly.
Last edited by Deren on Wed Nov 29, 2006 10:37 pm, edited 1 time in total.
poorsod
level1
level1
Posts: 42
Joined: Sun Nov 21, 2004 9:08 pm

Postby poorsod » Wed Nov 29, 2006 9:58 pm

I got my DEFCON from the Introversion mirror. You might have a bad connection.
User avatar
Montyphy
level5
level5
Posts: 6745
Joined: Tue Apr 19, 2005 2:28 pm
Location: London, England

Postby Montyphy » Wed Nov 29, 2006 9:59 pm

Personally, I get 404 errors trying to download from those mirrors. ;)
Last edited by Montyphy on Wed Nov 29, 2006 10:01 pm, edited 1 time in total.
Uplink help: Check out the Guide or FAQ.
Latest Uplink patch is v1.55.
User avatar
MrBunsy
level5
level5
Posts: 1081
Joined: Mon Apr 24, 2006 4:40 pm
Location: Southampton
Contact:

Postby MrBunsy » Wed Nov 29, 2006 10:00 pm

Interesting, those links currently give me 404 errors.

edit: damn, you beat me :P
User avatar
TheHappyFriar
level2
level2
Posts: 236
Joined: Sun Mar 05, 2006 7:59 pm
Location: upper left

Postby TheHappyFriar » Thu Nov 30, 2006 3:44 am

ok, now i'm confused. before you said the IV mirrors were fine, but now they sent you a virus? I'm getting a 404 error too.

I see two explanations:

a) they got hacked.

b) your browser is bugged & it's re-directing your download. I've had IE do this if it got bugged (that's why I don't use it). I got my DefCon from the first IV mirror when it was released, so it's something recent.
User avatar
shinygerbil
level5
level5
Posts: 4667
Joined: Wed Dec 22, 2004 10:14 pm
Location: Out, finding my own food. Also, doing the shinyBonsai Manoeuvre(tm)
Contact:

Postby shinygerbil » Thu Nov 30, 2006 10:52 am

Or, most likely, IV took down the mirrors as there aren't that many people downloading the game. But, as usual, they forgot to update the site.
Here is my signature. Make of it what you will.
Image
User avatar
wwarnick
level5
level5
Posts: 1863
Joined: Mon Oct 02, 2006 8:44 pm
Location: Rexburg, ID

Postby wwarnick » Fri Dec 01, 2006 9:48 pm

As for the virus, I once had a virus on my desktop, and Norton never detected a thing. We knew it was a virus because random things were going haywire. Anyway, we ran e-scan on it and it detected hundreds of infected files. We cleared them all and thought everything was okay. Unfortunately, when we tried to run Microsoft Word later that day, the shortcut couldn't find the executable. We checked and all but a couple folders in Program Files were completely empty. And all my software was legitimate. Your file may have been infected by a virus that's still on your computer. I recommend something better than AVG. Try a free e-scan. It won't clean the viruses, but you'll at least see if they're there. BTW - I don't use Norton anymore and never will ever again. The only virus Norton has ever detected on my computer was a worm. And at the time, I was using '98, so we were immune anyway.
The best combination of virus/spyware/firewall I know of (I'm no expert) is E-scan/Spysweeper/Sygate.

wwarnick

Return to “General”

Who is online

Users browsing this forum: No registered users and 2 guests