VOGONS


First post, by Argent

User metadata
Rank Newbie
Rank
Newbie

I really would like to use wonderful dgVoodoo library in my future open-source launcher project for an old multiplayer game (of course I will ask Dege’s permission later according to redistribution rights), but I am very worried about AI antiviruses false positives for this library.
So I really want to prevent AI antiviruses from triggering on future versions of the dgVoodoo .
I was able to find out that antiviruses mark most files as malicious in the first place by the presence of dgVoodooCpl.exe due to the calls possibly it contains (according to VirusTotal):

VirusTotal wrote:

1) EventID: 16. Sysmon Configuration Change. Detects a Sysmon configuration change, which could be the result of a legitimate reconfiguration or someone trying manipulate the configuration.

To be honest, I don’t quite understand what kind of dgVoodooCpl's action sysmon didn’t like.

VirusTotal wrote:
2) Stop Windows Service. - '\sc.exe' - '\net.exe' - '\net1.exe' CommandLine contains: 'stop' […]
Show full quote

2) Stop Windows Service.
- '\sc.exe'
- '\net.exe'
- '\net1.exe'
CommandLine contains: 'stop'

If the dgVoodooCpl really сontains code to stop some Windows service, is it possible to refuse this action?

Of course, I understand that the most reliable ways to stop AI antiviruses false positives are:
1) Get an expensive digital signature.
2) Write endlessly to the developers of AI antiviruses.
But both actions are generally quite costly in terms of money and time.

The only free thing I can suggest is to register on VirusTotal, scan several files from dgVoodoo (primarily dgVoodooCpl.exe) and give them a positive rating. Also leave a positive comment in the community section.

Well, or figure out which dgVoodooCpl calls these damn AI antiviruses respond to.

Reply 1 of 4, by Dege

User metadata
Rank l33t
Rank
l33t

Hi,
Do not believe a single word of AV's in regard of dgVoodoo, no matter what they say, it's complete bullshit. 😁
They can detect the wildest things, see this post where I analyzed an AV report on dgVoodooCpl (but the whole thread is about life-souring AV's):

Re: Google Safe browsing Advisory

So, I don't know what those service-tinkering statements are based on, not a single module of dgVoodoo deals with services.
The Cpl is just a plain Win32 GUI app that uses the same library for manipulating config files as the dll's themselves (for reading).

My main rule for AV's is that the built-in MS Defender is the only one I deal with (I can report false positives to MS), all the other are out of my scope. But anyway, I always run a scan on the zip's on VirusTotal when releasing a new version.
Nowadays only 3-4 out of the ~60 AV's reports false positives. Much better compared to the times 2-3 years ago, when it was 15-20 / 60. Also, MS Defender didn't detect the latest versions of dgVoodoo, so I didn't even report them.

Which game is that you making a launcher for? (Permission granted. 😀 )

Reply 2 of 4, by Argent

User metadata
Rank Newbie
Rank
Newbie
Dege wrote on 2022-03-24, 20:04:

Thanks for the detailed answer! I read the entire thread. Very funny, but also very sad.

Dege wrote on 2022-03-24, 20:04:

Which game is that you making a launcher for?

I'm writing a new launcher for my favorite "NetStorm: Islands At War" RTS. It will allow to play different versions of the game on modern systems and apply mods to the game in a couple of clicks. And it's also will allow easy to update the game to the current NetStormHQ fan patch (for playing on online servers).

I was interested in dgVoodoo, because only with dgVoodoo I can see NetStorm lightning flashes in the clouds 😀 The only problem is that when I turn on dgVoodoo, the gameplay in OBS stops capturing, but I will deal with this later.

Now my main task is to get rid of the old NetstormHQ launcher, because it is also falsely detected by AI antiviruses, and is morally obsolete. There are also plans to add a game modification system, without breaking the fan servers, which are still working thanks to the NetStormHQ community. When there is more news, I think I will share it in a Windows game thread somewhere on this forum.

Dege wrote on 2022-03-24, 20:04:

(Permission granted. 😀 )

Thank you!

Reply 3 of 4, by RetroGamer4Ever

User metadata
Rank Oldbie
Rank
Oldbie

Nothing popped up when I scanned the files with the latest version in McAfee and I always had issues with the older builds that I downloaded being flagged by that AV engine.

Reply 4 of 4, by TrashPanda

User metadata
Rank l33t
Rank
l33t

I used Nod32 mostly and have done for years but its not stupid like quite a few other AV programs and I have yet to have it throw false flags at me, the only other AV like program I used is Malwarebytes .. all I can say is its becoming increasingly annoying to the point I know keep it turned off unless I need to run a malware sweep on my PC once a month.

Actually getting to the point where I may just stop using Malwarebytes due to how overzealous its become with its heuristics and false flags, its safe browsing feature is ever worse for being a royal pain in the arse. (I've used malwarebytes for so long I have a permanent lifetime licence for it before they stopped that)

Ill likely keep Nod32 around since its rather benign on the system, doesnt even hog resources like other AVs do. (It barely uses 70mb of memory across its three background services)