One only need consider all of the possibilities and then it is probably the one that is the most likely that is the case. It's possible for anything anywhere to contain malware either on purpose or inadvertently for example. So is it even remotely possible that GOG has been shipping malware infected games to people? Certainly it's remotely possible. How? Well, they could be doing it on purpose and making money on the side from underground crime. Does that sound like a plausible thing for a publicly traded company to be doing, and would knowingly doing such a thing be more likely to be good for making money in the short term and/or long term? No, it doesn't sound like a good idea at all. Sounds like a terrible idea that would not really be good for making money in any timeframe compared to just selling a legitimate product that people want to buy outright the good old fashioned way of an honest business. Doing such a thing would only be a matter of time until it is discovered by someone, analyzed and able to conclude that shady business was happening, so anyone who would do such a thing would be pretty foolish as they ultimately get caught, and in the case of a company like GOG, the business and legal consequences would be enormous. So, is GOG knowingly distributing malware with their software? We could never know for sure but it is extremely unlikely when you deconstruct it as I have above.
So then... is GOG distributing malware unknowingly? Have hackers broken into their servers and infected the executables with malware? That's certainly possible also. Is it likely though? Probably not, because sooner rather than later all sorts of customers would be getting infected and quickly tracing it back to GOG. GOG would find out about it, look into it themselves and if their servers were breached or otherwise tampered with - such as a rogue employee or something, it would be discovered quickly. In order to protect customers, they would almost certainly not only fix the problem right away, but they would make a press release to disclose the fact that their company's servers were breached and inform people of what to do to protect themselves. They are likely required by law in some countries to do such a disclosure even, so if something like this were to happen for real - we'd find out about it rather quickly in the media and it'd be confirmed one way or another by the company themselves. The company would be doing everything they could to fix the problem and to protect their customer's trust and/or earn back the trust from anyone they lost it from. Is this scenario likely the case right now? Very unlikely as there is no mass reporting of infections or any suspicious behaviour that would lead one to suspect it is the case when there are much more likely scenarios at play.
Scenario 1: The virus scanner is triggering a false positive either due to a coincidental signature match which the AV company will have to tweak to make an exception for the given file(s) in the future and/or tweak their algorithms, or their heurestics engine are detecting some kind of behavior which is common to viruses but might also be common to video games. Self modifying (polymorphic) code for example is a technique used by malware but also by video games (for optimization), even though it isn't likely very common today it was highly common in the 90s.
Scenario 2: The person's computer itself is infected with a virus or malware that spreads virally, and that virus has attached itself to the GOG executable files that were downloaded - after the fact. Sadly, malware/viruses are rather successful at infecting the average person's computer because one or more people using a given computer are curious and trusting folk who are more likely to click on things and try them without worrying about security problems that might be present in doing so. So it is more normal of a thing for a person's PC to be infected than not, and an infected PC can easily spread malware to any executables or other files located on the system or even over the network via file shares. If the directory in which the GOG downloaded files exist is shared over a network, it is even possible that the computer itself might not be infected, but some other computer on the LAN is infected and could have infected the GOG files over the LAN.
So the real question is whether or not the files are actually infected or not, and if they are - to simply look at what the most likely reason would be overall for that to be the case. Is it more likely that a given person's computer is infected with a virus from lax computer security practices, or more likely that a major online game retailler has had their computer systems hacked into and malware being spread through them without anyone noticing and doing something about it, or more likely there is a false positive being detected by overly paranoid antivirus software?
From personal experience built over many years, if I had to stake $10000 of my own money on such a situation placing a bet on which of the possibilities I think is the case for a given system triggering an AV warning like this, my first bet completely blind without knowing the details is going to be that the PC hosting the files or some other machine that has come in contact with it over the network (LAN or wireless), or from a public wifi or something has infected it with something and that the files were not infected on the server they were downloaded from. My second guess would be a misdiagnosis/false positive from the A/V software.
The last possible thing I would expect would be that the files were distributed to me in an infected state from the retailer. It can happen, and probably has happened in the past somewhere out there, but it is the least likely thing one should expect to be the case for a given file being flagged as being potentially malicious.
Always look at all scenarios that are possible and while any of them very well could be the case, it is safest to assume the most likely scenario to be the case (an infected PC in this case) rather than the least likely (a malicious vendor or hacked vendor distributing malicious files knowingly or unknowingly) just by pure mathematics alone. ;o)
Having said that, if someone can confirm the files are infected on GOG.com please notify them so they can investigate the matter and work out that press release I eluded to above. I'm not expecting that to happen mind you. ;oP
silviucc: I would never have imagined that a simple question (that was competently answered btw) would give rise to this.
The GoG forums seen chock-full of computer security experts and malware analysts and I did not even know it... small world.
Everyone plays video games, including computer security experts and malware analysts. ;o)
