IAmSinistar: I would but the file is triggering my antivirus. :s
I just switched back to Avira and it's giving me grief again. It's reporting
raiden_legacy_v1.2.exe as having the
TR/Dropper.Gen trojan. I'm betting it's a false positive. Anyone else getting that?
Looks like I'll be dropping Avira again, right after I dropped AVG. Perhaps Avast will be the charm?
EDIT: Switched to Avast and no trojan. Man alive, see three doctors, get three diagnoses.
Any antivirus software will have false positives, either due to signatures that are too simple on some things (which might be necessary due to the nature of a given piece of malware, and require exclusion lists that get built up over time as false positives are detected and clarified), or due to heuristics detecting code that is often found in malicious looking code, such as self-modifying executables for example. Polymorphic code is very common in viruses/malware, but it is often used in video games as well as a method of optimization - especially back in the 90s. This was often done to runtime patch up function call tables to call functions that were hand optimized for a specific microprocessor after detecting what processor was used at runtime for example. By using polymorphism, the game engine eliminates one level of indirection per function call thus improving performance. But when a scanner scans code and finds code that modifies itself, unless it is able to look deeper than that and see what is happening and make heads or tales of it, it might just flag it as "self modifying code" which can trigger "possible virus alert". This is very difficult to write a scanner that could analyze code like that and know for certain whether it was just an optimization technique or is actually malicious code patching itself into a binary etc.
As such, all antivirus software will detect false positives with some programs from time to time. These get reported to the vendor by enough people and they update their software/database with hashes of safe executables or whatever technique they use to avoid false detection of that particular EXE in the future and it's in the next update. As such, you wont ever find an antivirus product that does not occasionally throw off a false positive really. Just use the software's built in mechanism to report the file and submit it for analysis. If it is deemed to be safe, they'll mark it as such for a future update. There's no getting around that other than not using heuristic scanners (which detect a lot of unknown threats, so isn't a good idea to disable), and even then - signature based scanning can still have false positives.
Otherwise you'll just hop from one scanner to another to another to another to another and eventually use all of them then go round full circle to the first one again and never find one that does not have this problem because it is a rather unavoidable problem.
