VOGONS

Common searches


First post, by Kerr Avon

User metadata
Rank Oldbie
Rank
Oldbie

Basically, I'm hoping that someone can say once and for all if the following program (and related files) are infected with malware or not. So if anyone here is familiar with the problem of false positives, and knows how to check for definite, please read on.

As you might know, current N64 emulators aren't exactly ideal, and so someone created a downloadable archive file containing an N64 emulator (no piracy, the emulator is freeware) and a 'mouse injector', the latter allowing you to use mouse and keyboard (WASD keys) to play Perfect Dark and Goldeneye the way you'd play a native PC first person shooter (and it works great, by the way). The archive doesn't contain Perfect Dark or Goldeneye, so it's OK for me to post the link here.

Anyway, some people have been saying that it's malware, a key logger, full of viruses, etc, and others say it's clean, that the virus killers' reports are just false positives. With me, Avast! never reported an infection, and Zone Alarm didn't tell me that the program was trying to access the internet, so I'd be inclined to think that it's all just false positives, but if there are any virus/malware experts on here, I'd really appreciate it if you could look at it and confirm or deny any infection.

The download is at:

https://archive.org/details/1964-GEPD-Edition

Thanks for any answers.

Reply 1 of 6, by VileR

User metadata
Rank l33t
Rank
l33t

'Injector' sounds like the kind of thing that'd raise every red flag for a virus/malware scanner, even if it's harmless.

If you're really concerned, run it in a virtual machine first and see what happens (and by that I mean "scan it thoroughly").

[ WEB ] - [ BLOG ] - [ TUBE ] - [ CODE ]

Reply 2 of 6, by SpeedySPCFan

User metadata
Rank Member
Rank
Member

Seems pretty safe. It's existed for a long time and and multiple people have used it with no problems.

Musician & music gear/game reviewer.

MIDI hardware: JD-990, SC-55, SC-880, SD-90, VL70-m, Motif ES, Trinity, TS-10, Proteus 2000, XK-6, E6400U

Reply 3 of 6, by Stiletto

User metadata
Rank l33t++
Rank
l33t++

I once had a similar problem with one of the wrappers/hooks/things in The Wrapper Project (really need to get back to that...), SquallStrife had given me a head's up that the host said one of the files contained viruses. I ran the actual file past peter.ferrie who posts here sometimes, and based on his approval I went along submitting "false positive" reports to anyone who flagged the file as potentially hostile at VirusTotal.com.

"I see a little silhouette-o of a man, Scaramouche, Scaramouche, will you
do the Fandango!" - Queen

Stiletto

Reply 4 of 6, by ZellSF

User metadata
Rank l33t
Rank
l33t

RiskWare.PEMalform! 20150226
Avast Win32:Malware-gen 20150226
Avira TR/Dropper.Gen 20150226
Cyren W32/Heuristic-KPP!Eldorado 20150226
F-Prot W32/Heuristic-KPP!Eldorado 20150226
GData Win32.Trojan.Agent.64T6LN 20150226
Ikarus Trojan.Dropper 20150226
McAfee Artemis!FC36A7368E92 20150226
Norman Suspicious_Gen4.HHULI 20150226
Rising PE:Trojan.Win32.Generic.125C8DE1!308055521

That's a lot of "Generic" and "Heuristic" results. AKA: we're practically just guessing there's a virus there, we're not really finding anything. If there was a virus there, there would be at least one definite definition of it: there isn't (Artemis is McAfee's heuristic solution, if you're wondering).

I would say the file is definitely clean.

Its behavior (being an injector) just leads to false positives.

Reply 5 of 6, by Gemini000

User metadata
Rank l33t
Rank
l33t

The "injector" process is what brings up the red flags for two reasons:

1. There's virtually no reason, save for remote computing, that you would EVER need to convert one form of input into another across programs, as typically programs are self contained and can do this kind of stuff themselves.

2. This is the exact same process some viruses use to take over computers or to intercept/record/transmit things like mouse motions and keystrokes.

If the code was integrated directly into the emulator, this whole injection process wouldn't be necessary and we wouldn't be discussing this... which makes me wonder why, after a DECADE, the emulator and add-on authors haven't collaborated together to get this done and put the whole injector/virus nonsense to rest. (If the code was right in the emulator itself, an injector would be unnecessary.)

I can't speak to how safe or unsafe this stuff is, but I can at least explain why this kind of programming is questionable. :P

--- Kris Asick (Gemini)
--- Pixelmusement Website: www.pixelships.com
--- Ancient DOS Games Webshow: www.pixelships.com/adg

Reply 6 of 6, by Kerr Avon

User metadata
Rank Oldbie
Rank
Oldbie
Gemini000 wrote:
The "injector" process is what brings up the red flags for two reasons: […]
Show full quote

The "injector" process is what brings up the red flags for two reasons:

1. There's virtually no reason, save for remote computing, that you would EVER need to convert one form of input into another across programs, as typically programs are self contained and can do this kind of stuff themselves.

2. This is the exact same process some viruses use to take over computers or to intercept/record/transmit things like mouse motions and keystrokes.

If the code was integrated directly into the emulator, this whole injection process wouldn't be necessary and we wouldn't be discussing this... which makes me wonder why, after a DECADE, the emulator and add-on authors haven't collaborated together to get this done and put the whole injector/virus nonsense to rest. (If the code was right in the emulator itself, an injector would be unnecessary.)

I can't speak to how safe or unsafe this stuff is, but I can at least explain why this kind of programming is questionable. 😜

Thanks for the insights, I appreciate it. And I too don't understand why existing N64 emulators are so haphazard. To run some games you need one emulator, and to run other games you need a different emulator (or a different version of the same emulator). And then you have to mess about with plugins, and even then many games still have timing or graphical glitches. Yet Gamecube and PS2 emulators are apparently much more compatible. Of all the machines I've tried to emulate, the N64 is by far the worst (emulation-wise, I mean). Hopefully when CEN64 and the N64 part of MESS are finished and released, they'll be 100% compatible, and also (I really hope) natively allow all sorts of control setups and features that don't require external programs or plug-ins.