Got Virus only in Blitz-compiled EXE's

Hi,

yesterday AntiVir reported "JOKE/RapSter" found on some files on my system. This infection seems to spread cause today it reported more files to be infected. There are a few facts that look strange to me:

* Only files compiled with Blitz are affected (Giles, TeD, some of my own), and all those exe's got links on my desktop. Other EXE's linked to my desktop were not infected, only those compiled with blitz.

* Scanned it with Virustotal.com => only Antivir and Avira detected "JOKE/RaPster", Fortinet found it "suspicious", all other scanners found nothing.

* I cant find any information about JOKE/RaPster on the net. Absolutely nothing.

First I thought about a wrong alert with heuristic detection and blitz-apps. What speaks against this theory is the fact, that the number of files infected increase, so there must be something going on.

Any ideas what's going on or information about JOKE/RaPster would help a lot...

Have you done a spyware/Malware check... Use Adaware, or something similar, also, run your scanners in windows safe mode with command prompt (If possible)

If all else fails... email your Anti-virus company

I hope its something else, because the thought of somebody attacking my apps because they are Blitz, gives me a shiver!

.

The weird bit is that JOKE/RapSter isn't even in the Antivir online virus database. Best to take it to their support forums I guess or email them directly to see what's going on.

Thinking about it, it's pretty easy to find a Blitz executable in someones system, you look through their hard drive, searching out EXE files, open them up for reading, and scan through them for Blitz related strings, such as a class name e.g. "BLITZMAX_WINDOW_CLASS"

Once this has been found, a program has the path for the executable to do whatever he/she (let's not be sexist) pleases...

On top of that, we download each others stuff all of the time, someone could easily piggy back a nasty on top of a legitate game/app!

Scary!!!

Has someone been getting the hump lately or something?

[edit]
Just noticed, I checked an EXE for the class name, but it was compiled using BP, though, the class name contains BLITZMAX??? Weird!
[/edit]

I had something similar when I downloaded the EarthGlobe screensaver from the Blitz Main page about 5 months ago (or thereabouts... it installed spyware on my system as well...)

BlitzPlus and BlitzMax share a small part of the same code base...

Some of the later additions to BlitzPlus were written simultaneously for BlitzMax.

yap antivir makes alarm but

goto options an dissable the search for "jokes"

I have the same problem yesterday and mailed this to H+BEDV

only Blitz Files have this problem.

@Panno

...or wear sunglasses that turn black in dangerous situations ;)

Update: This thing isn't spreading - number of files infected kept the same since yesterday. I got confused by turning on "Scan archives". The signature was also found in blitz\runtime.dll, so I think it's a wrong alert.

Maybe someone released a joke virus coded in blitz?

I found this just today: http://72.14.203.104/search?q=cache:wN354eiBge8J:forum.zebulon.fr/lofiversion/index.php/t85525.html+JOKE/RapSter&hl=en&ct=clnk&cd=1

there're really just the signatures, that are equal mades. this happens from time to time, due to the increasing count of viruses...no reason to panic. could be fixed by mark by just changing a small bit of the compiler...in the mean time: just disable the detection of jokeware, it's nothing dangerous anyway... ;)

I downloaded and scanned with AntiVir PE Classic (and updated it) and came up clean! Am I using the wrong thing?

[edit] No - I hadn't configured the bliddy thing. Now it shows all blitz exe's as having the joke/rapster thang. I'd hate to think I'd been left out.

Outch:

C:\a\twilight
twilight.exe
[DETECTION] Contains signature of the joke program JOKE/RaPster
WAS DELETED!

That was my fps demo :.[

Hey, what's the current status os this issue? I mean, I hate to feel the need to add comments like:
game.zip (BTW if your Antivirus says there's a virus, it's not, it' sonly the way my app has the same signature as th evirus because it was compiled with the same compiler and blabla)

You know, most people won't touch a file even when they only read "virus" somewhere, regardless of any context. And, if I don't say anything, some people may say I was spreasing viruses.

AntiVir is a popular app and they are highly respected. Andrea, did they answer yet?

So what's up?

Nothing new here. Have to check if the latest B3D-Update got the same problem. Anyone checked this with B+ ? (don't have it).

lol what i say


goto options an dissable the search for "jokes"
free- av search now for all real viruses

The real problem is that this virus scanner gives a false positive identifying all B3D exe's. Did you bring this up and explain to the antivirus vendor?
their detection signature for this 'virus' is much to broad, after all. Unless changed, it will likely continue to flag all B3D exe's forever... (Or worse, if other antivirus companies decide to incorporate their signature, the problem could spread to other anti virus programs as well)

Heh. Next we'll need anti-antivirus-signatures detection.

Molebox had a similar problem, and it feels pretty bad when you release a freeware tool, you know the spirit of freeware etc., and then some noob kids are shouting "GOT VIRUS FROM YOU".

I think I'll write a letter or mail to the antivir guys soon. Maybe it's gonna help if some of you guys will do the same.

the best solution @ JFK

I found the virus over on CodersWorkshop in the Poc_Man showcase entry... Seems that the exe is packed pretty tight, though, the scanner said there were three accounts of the virus in the packed file!!!

I've cross referenced my freshly built B3D exe's and they are fine!

God knows whats going on?!?

Dabz

Really?!? What version of Blitz3D are you using?

Runtime version V1.91

I've just got in from work, and my new B3D exes are still fine!

Though, I mucked out a lot of Blitz related stuff I downloaded, had a Google on processes... There was a couple of unknowns, so I've shipped them out too, and everything seems fine!

Dabz

Could you check this file please:
http://www.melog.ch/csp_slomo/csp_slomo_03.zip

It's compiled with 1.91 too, so if it won't act the same way, there's something wrong.

Having a look now jfk mate!

Dabz

Seems fine, I had all the options ticked in the 'unwanted programs' list and it's clean!

I'm updating the definitions now, so... I'll rescan when they arrive!

Dabz

thanks!