Morrowind Overhaul 3.0 - Trojan Warning

[SevR]

I downloaded the latest version of the Morrowind Overhaul mod from ornitocopter.net which is supposed to be the authors site. An ESET a/v scan comes back with an "MSIL/Agent.KNQCKJS trojan found" warning in several of the .exe files containd in the packed mod.

If it were avast, I would side with it being a false positive, due to their super paranoid engine but I've worked with ESET for a few years now in different environments and not one false positive yet. I'm not saying it's out of the question, just not in my experience.

Be mindful of 3rd party mods, in any game.

[Mr. Stimpson]

I'm just downloaded it 30 minutes ago from ornitocopter.net. Scanned the packed.rar file with MSSE and Avast and both runs came back threat free.

I'm going to scan the packed.rar again before I open, then scan it again once I unpack it. I hope that your scans were a fluke to be honest. I've been excited to try this mod out for some time now.

Can anyone else add to this?

[EgoMaster]

It's a false positive. The exe files in packed.rar are all well-known software which have been around for years. You don't need to be mindful of 3rd party mods, just be mindful about where you get them from. Steam Workshop, Moddb or game specific sites (like Planet Elder Scrolls or Morrowind Nexus) should be OK. No need to get overly paranoid.

[SevR]

ESET has been known to catch virus' in the wild, could go either way however I choose to not use the mod for this reason. I downloaded the .rar 3 times and all 3 times found the same virus in the MGEStable.exe, MGSOO_Exeoptimizer.exe, MGSOO_MGSOOptions.exe, and the MGSOOptionsAfterInstall.exe.

Over the years of mods for games there have been dozens of idiots trying to exploit peoples trust. Recent years has more attempts to get peoples credit and or other info than ever before, even Steam fell prey to such an attack. Third party mods should be especially suspect.

To disregard a virus found would be pure stupidity. I choose to not be stupid, and so should anyone else.

[SevR]

5 months later, and several (hundred-with eset) .dat file updates and this 3rd party (just some guy/people) still sets off 2 virus scanners. ESet in real time when its running the install and Clam AV on Debian in its packed form. Beware the Overhaul, if you're still using a windows o/s download "System Internals Software Suite" and "Process Hacker" from Sourceforge to check your Windows process'.

[SaLaĐiN]

It is a FP and stop spamming with your godlike Eset, I was using it for a year and it made lots of FPs. For example, regularly detected my steam games .exes as trojans - Unreal Tournament Gold, UT 2k4 etc.

[__-__-__]

Originally posted by EgoMaster:

It's a false positive. The exe files in packed.rar are all well-known software which have been around for years. You don't need to be mindful of 3rd party mods, just be mindful about where you get them from. Steam Workshop, Moddb or game specific sites (like Planet Elder Scrolls or Morrowind Nexus) should be OK. No need to get overly paranoid.

Again. If you are going to try to mod a game you do need to be aware of possible viruses but you must also be aware that some mods get flagged when nothing is there. If you are concerned about a file, download multiple virus scanners to see if they all come up with similar results.

[$n@ke Eye$]

Morrowind Overhaul 3.0 is probably detected as a false positive because there are times during the installation process that it takes control of your computer and your mouse becomes unresponsive while it sets everything up for you. I can see why that would be detected as a possible trojan.

[SevR]

I'm just putting it out there, Overhaul is detected by two not just one a\v program. Since "Saladin" opened the door, I dislike eset or anything windows for that matter, but eset does use a high quality a/v detection engine for viruses in the wild and uses almost no memory to do it. False positives were not the problems experienced with eset, plenty in other areas however. When the contract runs out I definately won't renew it since having to boot windows is getting to be less and less, and on a well configured Linux system using an a/v program is like adding a layer of paper to your kevlar armor.

I do remember around '04-'05 a mass infection of a "Code Red" variant spread through a crackd ut2k4 windows executable. Since I don't use cracked programs and ut2k-ut2k4 were all playable natively in Linux I never had a problem, sucked for Epic though.

So let's review, Overhaul is detected by two a\v programs as having virus', the installer is different than any other game patch/expansion/update of games to date in the form of hijacking the mouse coursor (who knows what else) and is made by some guy or group of people that is not affiliated with ZeniMAX, Bethezda or id software.

Use at your own risk.

[__-__-__]

Originally posted by ^2W^7yr^2M:

I'm just putting it out there, Overhaul is detected by two not just one a\v program. Since "Saladin" opened the door, I dislike eset or anything windows for that matter, but eset does use a high quality a/v detection engine for viruses in the wild and uses almost no memory to do it. False positives were not the problems experienced with eset, plenty in other areas however. When the contract runs out I definately won't renew it since having to boot windows is getting to be less and less, and on a well configured Linux system using an a/v program is like adding a layer of paper to your kevlar armor.

I do remember around '04-'05 a mass infection of a "Code Red" variant spread through a crackd ut2k4 windows executable. Since I don't use cracked programs and ut2k-ut2k4 were all playable natively in Linux I never had a problem, sucked for Epic though.

So let's review, Overhaul is detected by two a\v programs as having virus', the installer is different than any other game patch/expansion/update of games to date in the form of hijacking the mouse coursor (who knows what else) and is made by some guy or group of people that is not affiliated with ZeniMAX, Bethezda or id software.

Use at your own risk.

That statement can go for using any mods at all. There is a possiblity that even a simple mod could crash one's computer if it is put together badly enough. And many mods can make the game unplayable if they aren't installed correctly.

Let me ask this, if MGSO is so riddled with viruses, why is it the most recommended mod for Morrowind? If it were so dangerous wouldn't more people be saying what you are saying?

[SevR]

Originally posted by Sesh:

That statement can go for using any mods at all.

Correct, be mindful of any non official mods.

Originally posted by Sesh:

There is a possibility that even a simple mod could crash one's computer if it is put together badly enough.

Correct again, all though off topic. Linux and Unix operating systems have package managers and the ability to install from the source code, Microsoft uses a Windows installer.

Originally posted by Sesh:

Let me ask this, if MGSO is so riddled with viruses, why is it the most recommended mod for Morrowind?

Where do you get this information?

Originally posted by Sesh:

If it were so dangerous wouldn't more people be saying what you are saying?

Not if they do not use an a/v that can catch virus' "in the wild". As opposed to "commodo" which is absolute garbage-ware. I've had eight customers alone this year where I had to forcefully remove commodo's "security software" because it failed miserably to do its job, and then clean the operating system.

What I am saying is be mindful.

Originally posted by Alkpaz:

Microsoft Securtity Essentials does not report an issue either. This mod has been out there for quite some time and Microsoft never found out about it?! What about Malwarebytes and Comodo not reporting an issue either, that is 3 to your 2. I do believe Norton never had an issue with it either back in the day.

Quite some time?! Less than a year for 3.0. Microsoft Security Essentials is the absolute basics of a/v software, they have put it out just to have their name out as the company is doing so badly. Catching virus' in the wild is not their forte. Malware bytes was good at detecting malicious software loaded in your web browser cache and possibly migrating to other partitions or directories, not catching Trojan's and worms. They do offer a/v detection currently but I'm not sure who they are buying their a/v scan engine from. If I had to guess I'd say Panda.
"Back in the day"? Norton has been garbage-ware since the late 90's, 'course if you don't know...then you just don't know.

[Siddha]

Originally posted by ^2W^7yr^2M:

.....and is made by some guy or group of people that is not affiliated with ZeniMAX, Bethezda or id software.

Use at your own risk.

Sorry, but if you knew anything about mods you would know this is a completely daft statement.

[Fernandohyde]

LOL at this thread, OP is dead set on convincing everyone that MGO Overhaul is some sort of elaborate scheme to infect people's computers with viruses, based soley on the fact that his virus scan picked it up. And obviously his virus scan is vastly superior to every other virus scan program out there just because he uses it (logic of OP), LOL. I can also add, that I have Bitdefender and it didn't pick anything up. Not that my opinion would matter to OP since he made his mind up already.

[Toni 'Bō' Jones]

The only thing I am convinced now that author of this topic is advertising ESET.

Thousands of people donwloaded that patch and still use it 24/7, I amongst them as well and never run into any issues like that. Leave alone the idea it is 3d version of this mod package and this is not even a one-man project. Those guys have worked their socks off to get this beauty and have main site, forum and different contacts for any question.

I will say - get some rest to your beloved antivirus and enjoy the game ;)

[__-__-__]

Originally posted by ^2W^7yr^2M:

Originally posted by Sesh:

That statement can go for using any mods at all.

Correct, be mindful of any non official mods.

Originally posted by Sesh:

There is a possibility that even a simple mod could crash one's computer if it is put together badly enough.

Correct again, all though off topic. Linux and Unix operating systems have package managers and the ability to install from the source code, Microsoft uses a Windows installer.

Originally posted by Sesh:

Let me ask this, if MGSO is so riddled with viruses, why is it the most recommended mod for Morrowind?

Where do you get this information?

Originally posted by Sesh:

If it were so dangerous wouldn't more people be saying what you are saying?

Not if they do not use an a/v that can catch virus' "in the wild". As opposed to "commodo" which is absolute garbage-ware. I've had eight customers alone this year where I had to forcefully remove commodo's "security software" because it failed miserably to do its job, and then clean the operating system.

What I am saying is be mindful.

Originally posted by Alkpaz:

Microsoft Securtity Essentials does not report an issue either. This mod has been out there for quite some time and Microsoft never found out about it?! What about Malwarebytes and Comodo not reporting an issue either, that is 3 to your 2. I do believe Norton never had an issue with it either back in the day.

Quite some time?! Less than a year for 3.0. Microsoft Security Essentials is the absolute basics of a/v software, they have put it out just to have their name out as the company is doing so badly. Catching virus' in the wild is not their forte. Malware bytes was good at detecting malicious software loaded in your web browser cache and possibly migrating to other partitions or directories, not catching Trojan's and worms. They do offer a/v detection currently but I'm not sure who they are buying their a/v scan engine from. If I had to guess I'd say Panda.
"Back in the day"? Norton has been garbage-ware since the late 90's, 'course if you don't know...then you just don't know.

The mod is the most recommended mod on the Steam forums to my eyes, which may be wrong, but whenever anyone asks for recommended mods it is usually the first one mentioned, I have no academic source for this information (If you do and it says other than I do I would love to see it).

My point about how the mods popularity makes it safer was poorly stated, in general mods that have true viruses or don't work as stated fail, if many people like and recommend a mod it is likely that it does what it says (and the chances that they all have crap AV are very low).

Your point that everyone must be careful in the mods they download and use is an important one that too few people bring up. However virus scanners frequently find one another to be viruses, the point being they are tools, not authorities, they are stupid, they can't make decisions for themselves. If you get a positive scan from a mod it is a good idea to find out if others find the same, not assume your scanner is always right.

[SevR]

Originally posted by Alkpaz:

http://forum.rpgitalia.net/topic/13642-introduction-i-need-help/

http://www.gamefaqs.com/boards/935550-the-elder-scrolls-iii-morrowind-game-of-the-year/66333947

http://forums.nexusmods.com/index.php?/topic/883156-morrowind-overhaul-sounds-graphic/

http://forums.steamgames.com/forums/showthread.php?t=3112293

This one is a bit more informative:

http://forums.iobit.com/showthread.php?p=94702

Seems like this is pretty common in the design of the program itself:

http://forums.steampowered.com/forums/showthread.php?t=2114906

2011.. Which is about when I heard about it.. ^^

"fire up wireshark or another packet sniffer to see where the traffic goes."

If Comodo is so terrible why would Cnet give it a "thumbs up"?

All Star Editor Rating: http://download.cnet.com/Comodo-Internet-Security/3000-2239_4-10460704.html

5 Stars from Cnet which is part of ZiffDavis, which is the publisher of PC Magazine. (It was thicker back in the 90s)

I went back to Norton a year or so ago didn't renew, since in the 90s you didn't have to renew.

First HAHA! CNet the center for Microsoft slanted mis-information spreading, but again if you don't know..you just don't know.

You made some links to links for what? PC Magazine was/is a fluff mag, we used to read it for a good laugh like NewEgg reviews, usually 180 degrees from accurate.

You had to renew Norton with a new version every year so yes you had to renew annually.

I say "Commodo" software is garbage because that has been my experience with it, not reading what others are telling me about it.

Originally posted by Siddha:

Originally posted by ^2W^7yr^2M:

.....and is made by some guy or group of people that is not affiliated with ZeniMAX, Bethezda or id software.

Use at your own risk.

Sorry, but if you knew anything about mods you would know this is a completely daft statement.

Seems you do not know what "daft" means or you do not know who wrote the elderscrolls series, I'm guessing both.

Originally posted by Fernandohyde:

LOL at this thread, OP is dead set on convincing everyone that MGO Overhaul is some sort of elaborate scheme to infect people's computers with viruses, based soley on the fact that his virus scan picked it up. And obviously his virus scan is vastly superior to every other virus scan program out there just because he uses it (logic of OP), LOL. I can also add, that I have Bitdefender and it didn't pick anything up. Not that my opinion would matter to OP since he made his mind up already.

Is the entire posting lost on you? That is what it seems like, you should read text only with more objection you might intake more of what is being stated.

As I previously typed, and clearly the only one understanding what the term "On Topic" means. Two a/v scan programs find virus' in the packed mod, and it's the only mod/expansion/update for a game that needs to actually take control of your computer to installl itself.
Be mindful of any thrid party mods!