TROJAN Virus inside audio file

[Grimothos]

TROJAN Virus inside audio file

Game had a normal patched today, and Norton was set off by a Trojan Virus contained inside of the audio file "amientocean.ogg"

Dev's, please take imediate action!

Here is the anti-virus Log text for the suspect activity:

Filename: ambientocean.ogg
Threat name: Trojan.Gen.NPE.2Full Path: x:\steam\steamapps\common\colony survival\gamedata\audio\ambientocean.ogg
____________________________

On computers as of 
7/4/2017 at 7:09:10 PM

Last Used 
7/4/2017 at 7:11:11 PM
Startup Item 
No
Launched 
No

Threat type: Virus. Programs that infect other programs, files, or areas of a computer by inserting themselves or attaching themselves to that medium.
____________________________

ambientocean.ogg Threat name: Trojan.Gen.NPE.2
Locate

Very Few Users
Fewer than 5 users in the Norton Community have used this file.

Very New
This file was released less than 1 week  ago.

High
This file risk is high.
____________________________

Source: External Media
Source File:
ambientocean.ogg
____________________________

File Actions

File: d:\steam\steamapps\common\colony survival\gamedata\audio\ ambientocean.ogg Removed
____________________________

File Thumbprint - SHA:
3b1973ca8c9e45ba8c9df0948b4fce2f0ef6712ee88cada10aa89fb67c37d77d
File Thumbprint - MD5:
89862bfc43affad178c1813fdf319ae2

[2005Guyver02]

Just had a trojan warning:

As state above. The file is the: ambientocean.ogg


Edit: exect wording: Trojan.Gen.NPE.2 (detected and removed)

[Graviti]

I got this as well.

[Koutetsusteel]

Devs will probably have to submit the file to Norton for them to check it.

Also, why are people still using Norton? It's worse than a lot of the spyware/adware/viruses that it tries to get rid of :|

Also, I love how they say the file risk is high, but yet on their website, they say "Risk Level 1: Very Low" and that it's a "generic detection" for which "specific definitions" have not been created.

[Shriker]

The chances of an .ogg file having a virus are practically non-existent. If someone had figured out a way to transmit a virus using an MP3 or OGG file, we'd probably have heard about it by now because half the world would be infected.

[Zun]

Well...I've done as koutetsu advised, and submitted the false positive to their website.

If you're running Windows 10, I'd advise to not run a seperate virus scanner and leave it to the default windows defender. Sadly computers still come with all kinds of bad software that isn't needed.

Disclaimer: I'm not responsible for your viruses. (Though I guess norton does claim me to be a l33t hackz0r)

[Grimothos]

Originally posted by 2005Guyver01:

Just had a trojan warning:

As state above. The file is the: ambientocean.ogg

Edit: exect wording: Trojan.Gen.NPE.2 (detected and removed)

2005Guyver01:
Yes, thankfully it was detectred and removed before it could deploy its "command payload."

Originally posted by Koutetsusteel:

Devs will probably have to submit the file to Norton for them to check it.

Also, why are people still using Norton? It's worse than a lot of the spyware/adware/viruses that it tries to get rid of :|

Also, I love how they say the file risk is high, but yet on their website, they say "Risk Level 1: Very Low" and that it's a "generic detection" for which "specific definitions" have not been created.

Koutetsusteel:
Our Norton detected this one as High risk. I agree that Norton is bloated software..But it worked, and that's what matters. Reason for still using Norton: it is free as part of our Internet service from Xfinity/Comcast. At least it worked.

Originally posted by Shriker:

The chances of an .ogg file having a virus are practically non-existent. If someone had figured out a way to transmit a virus using an MP3 or OGG file, we'd probably have heard about it by now because half the world would be infected.

Shriker:
While I partially agree that a normal *.ogg file is no threat, it could easily be a renamed file extension and actually be a disguised trojan virus, or trojan command payload, which is called out from a different piece of the trojan virus to wreak havoc. Any file extension can contain pieces of a virus and you would never suspect it. Please take a look at the recent virus types being deployed by the bad guys as ransomware, and you will see prime examples.

...........................................


The important point is, the Developer deployed an infected file to EVERYONE who owns this game, and they need to take imediate action to fix it.

[Grimothos]

Originally posted by Zun:

Well...I've done as koutetsu advised, and submitted the false positive to their website.

If you're running Windows 10, I'd advise to not run a seperate virus scanner and leave it to the default windows defender. Sadly computers still come with all kinds of bad software that isn't needed.

Disclaimer: I'm not responsible for your viruses. (Though I guess norton does claim me to be a l33t hackz0r)

Zun,

You sent out this file as part of a recent patch, and you are responsible; nobody else, period.

Microsoft has great OS and Dev tools, but the malware tools are a joke; Windows Defender is only a removal tool and not a very good one, it was never designed to act as a detection tool.

Heck, Microsoft themselves advises people to run a third party application for detecting and stopping virus activity, such as Kaspersky, Norton, etc. You telling folks to not run antivirus protection is outrageous in this age of ransomware and leaked virus creation tools... Wow... Seriously?

The game is great, otherwise I would not have spent 23 hours on it so far. However, there was a patch of your game through Steam which flagged as a virus right after the download completed... No other activity prompted the virus software, juyst the update to your game, that you created.

Originally posted by Zun:

Disclaimer: I'm not responsible for your viruses. (Though I guess norton does claim me to be a l33t hackz0r)

Wow! These are YOUR game files.. And YOU are blaming US for the virus from your updates? Are you insane?

You obviously received very low grades in brand recognition and marketing basics classes.

Insinuating, or implying that the end-user somehow caused the virus to happen from your update is very insulting.

-Bad move snowflake-

If you send out another virus laden file, you will be reported to Steam... over and over and over and over and over...

Get my point? Fix it - Don't blame us for what you sent out - Just fix it.

[ramavich007]

Just because the POS called Norton "detected" anything at all doesn't mean squat. I quit using the bloated, over-reacting, POS virus that calls itself Norton a decade ago. The first thing our IT department does to any new PC that comes preloaded with that crap is uninstall the heck out of it. Sometimes that proves to be extremely hard as it seems to actively fight you kicking and screaming to it's inevitable death in the recycle bin.

[RagingPapaBear]

I use Trend Micro, it detected this same issue, so I don't find just Norton being the only virus scanner finding this as an issue. Please be more cautious with your game files. Thanks ^^

[Grimothos]

Originally posted by ramavich007:

Just because the POS called Norton "detected" anything at all doesn't mean squat. I quit using the bloated, over-reacting, POS virus that calls itself Norton a decade ago. The first thing our IT department does to any new PC that comes preloaded with that crap is uninstall the heck out of it. Sometimes that proves to be extremely hard as it seems to actively fight you kicking and screaming to it's inevitable death in the recycle bin.

ramavich007,
Lol.. you are SO right; Norton is a bloated monster that is better suited as a bandaid, which is why I tested my system using Kaspersky and Trend Micro after the initial detection.

[JediMage]

I got DHP:Trojan.Inject.2 in colonyclient.exe with DrWeb when tried to open the manual O_o

[Koutetsusteel]

I'm listening to ambientOcean.ogg right now. Man, these soothing ocean waves sure do sound like a virus! [/sarcasm]

In all seriousness though. Stop being a ♥♥♥♥♥♥♥ moron, Grimothos. It's not an actual virus; it's a false positive.

You're going to feel really stupid after Symantec looks at the file and deems it as a false positive -_- Or at least more stupid than you should already feel. You're sitting here calling the dev a snowflake because he made a disclaimer... how much of an teenage edgelord are you? The disclaimer was in regards to his previous advice about using Windows Defender. He gave advice and then posted a disclaimer stating that if you use said advice, he isn't responsibile for any viruses incurred. Try to keep up, will you?

[Koutetsusteel]

Originally posted by ramavich007:

Just because the POS called Norton "detected" anything at all doesn't mean squat. I quit using the bloated, over-reacting, POS virus that calls itself Norton a decade ago. The first thing our IT department does to any new PC that comes preloaded with that crap is uninstall the heck out of it. Sometimes that proves to be extremely hard as it seems to actively fight you kicking and screaming to it's inevitable death in the recycle bin.

Yep. Had 3 years of I.T. and Network security classes and all we ever talked about when it came to Norton is how horrible it is. In many cases it is worse than the viruses it claims to protect against. There are often times where you have to download a third party program just to UNINSTALL Norton because it won't ever uninstall properly (it lingers on your system. you know, like a virus?)

[Koutetsusteel]

Originally posted by Grimothos:

Originally posted by ramavich007:

Just because the POS called Norton "detected" anything at all doesn't mean squat. I quit using the bloated, over-reacting, POS virus that calls itself Norton a decade ago. The first thing our IT department does to any new PC that comes preloaded with that crap is uninstall the heck out of it. Sometimes that proves to be extremely hard as it seems to actively fight you kicking and screaming to it's inevitable death in the recycle bin.

ramavich007,
Lol.. you are SO right; Norton is a bloated monster that is better suited as a bandaid, which is why I tested my system using Kaspersky and Trend Micro after the initial detection.

I just ran a scan using an updated Kaspersky and it didn't find anything, so...

And I also ran Malwarebytes (which I trust wayyy more than Norton) and it didn't find anything either.

[Zun]

Originally posted by Grimothos:

Yes, thankfully it was detectred and removed before it could deploy its "command payload."

<SNIP>

Our Norton detected this one as High risk. I agree that Norton is bloated software..But it worked, and that's what matters. Reason for still using Norton: it is free as part of our Internet service from Xfinity/Comcast. At least it worked.

<SNIP>


The important point is, the Developer deployed an infected file to EVERYONE who owns this game, and they need to take imediate action to fix it.

Originally posted by Grimothos:

Zun, You sent out this file as part of a recent patch, and you are responsible; nobody else, period.

Microsoft has great OS and Dev tools, but the malware tools are a joke; Windows Defender is only a removal tool and not a very good one, it was never designed to act as a detection tool.

Heck, Microsoft themselves advises people to run a third party application for detecting and stopping virus activity, such as Kaspersky, Norton, etc. You telling folks to not run antivirus protection is outrageous in this age of ransomware and leaked virus creation tools... Wow... Seriously?

The game is great, otherwise I would not have spent 23 hours on it so far. However, there was a patch of your game through Steam which flagged as a virus right after the download completed... No other activity prompted the virus software, juyst the update to your game, that you created.

<SNIP>


Wow! These are YOUR game files.. And YOU are blaming US for the virus from your updates? Are you insane?

You obviously received very low grades in brand recognition and marketing basics classes.

Insinuating, or implying that the end-user somehow caused the virus to happen from your update is very insulting.

-Bad move snowflake-

If you send out another virus laden file, you will be reported to Steam... over and over and over and over and over...

Get my point? Fix it - Don't blame us for what you sent out - Just fix it.

As I stated above, this is an obvious false positive, and I sent it over to norton for them to fix (because as I said, it is not me that causes the issue here). They have responded since and added the files' hash to their whitelist in the newest virus definitions.

False positives are the problem of the antivirus.
True positives in the context of this game would be my problem.
True positives in the context of illegal games or so would be the users problem.

The only case that is up for me to fix in the game files is the 2nd one.
The first is up to norton to fix - this time with me sending the file to them.

The end-user is responsible in the sense that they're using an antivirus product that has a high rate of false positives, and thus gets the false positives. Calling detecting a false positive to be the product 'working' is also slightly strange.


To say Windows Defender is "only a removal tool" and microsoft "recommends a proper antivirus" is a bit outdated as far as I know, I'd appreciate some recent reports and a recent quote from microsoft on that. It has substantially increased in scope since the windows 7 days. They are now making "Microsoft signature pc's & laptops" that do not have any 3rd party bloatware - including no 3rd party antivirus software. If people were very vulnerable that way they surely wouldn't release it that way.

By now Windows Defender also includes rootkit defending, realtime scanning, uploading false positives to the cloud for better analyzing etc.

But to come back to my advice of running only Windows Defender; The problem is a bit two-sided. If you are constantly downloading illegal porn & clicking on the ads these type of sites present or other shady things, you're going to catch a virus. Irrelevant of your antivirus. Whether you have a nagging McAfee or not. It's probably better still to have a more proper antivirus, which (in my opinion that hasn't touched the products) seems to be something like Kaspersky or Malwarebytes' antivirus. But you're catching a virus anyway.

If you are aware of what to click on and what not (i.e, aware of the shady download buttons etc), odds are you can do better with Windows Defender not breaking your applications & nagging you for updates / licenses etc.

The antivirus priority tree is basically these, with A) being optimal security/usability.
A) Malwarebytes / Kaspersky / various other reputable ones, paid.
B) Windows Defender / malwarebytes / kaspersky / some other reputable ones, free editions.
C) Norton, McAfee, tons of otheres, paid.
D) C) but free.
E) No antivirus at all.

Now in light of most peoples' pockets and willingness to pay, you're ending up at B). Of those things, the free editions will likely create popup ads to buy the full version, numbing the user to actual threats (it's a similar popup).

It's turning into a bit of a random rant, so I'll stop here for this post.