[IMPORTANT] About viruses - how to avoid being infected

[quote=~ r a z e r _;10792388]I feel like it's time to correct some false statements, concerning the following topics:

- [url]http://www.elitepvpers.com/forum/warrock/1076084-ber-das-aussortieren-von-viren-eine-hoffentlich-anregende-kritik.html[/url]
- [url]http://www.elitepvpers.com/forum/warrock/896339-allgemeine-infos-ber-viren-etc.html[/url] [pinned once]
- [url]http://www.elitepvpers.com/forum/warrock-hacks-bots-cheats-exploits/876654-schutz-vor-viren-protection-against-viruses.html[/url] [pinned once]

[B][U]outline:[/U][/B]

- What exactly is a virus?
- Tips and tricks related to viruses
- Viruses and game hacking - why cheats are often notified as viruses by many scanners
- Closing words

[B][U]What exactly is a virus?[/U][/B]

Every computer user knows the term "virus" - even though just a few of these know the meaning of "virus". In fine, it's a "damaging program routine of lowest size, which does replicate and spread by itself". In fine, actually no one get this. A virus is, spreading the topic from small to large, a very small program which replicates itself, so I won't get deleted. A program which you can't just deleted the usual way, something that is used to delete or damage data or even broadcast saved data such as passwords.

[B][U]Tips and tricks related to viruses[/U][/B]

In short:
- NEVER turn of the firewall
- ALWAYS run an anti virus software - Attention: You should not run more than one anti virus software at the same time, as they could block each other.
- Programs with unknown origin should be ALWAYS downloaded into a sandbox. A sandbox is a closed system, which does relocate itself every time you boot to the installation's point. This could be e.g. a virtual machine. People who are interested in this topic should fix themselves up with VMWare.
- You should not just test your autostart regularly for unknown executables, but you should also use programs like Kernel Detective to scan for hidden processes you cannot relate to any of your applications.
- Keyloggers necessarily feature some kind of network activity. You can use Netlimiter to check for it.
- Nobody is "trusted".
- NEVER use one master password for your accounts.
- Always mind the respectability of the person providing the download.
- Always mind the files' sizes - Example "Naeron Injector": this injector has the original size of 197 kB; a bound injector would have a larger size (there are also very small of only a few kB, so caution is advised here)
- If necessary, lock up the checksums as explained in [url]http://www.elitepvpers.com/forum/warrock-hacks-bots-cheats-exploits/478559-important-hacks-fake-vt.html[/url].
- [url]http://www.elitepvpers.com/forum/technical-support/1005375-info-gefahren-im-internet.html[/url] - Just read it, it's very informative.

[B][U]Viruses and game hacking - why cheats are often notified as viruses by many scanners[/U][/B]

Here you have to differentiate between two things: the injector and the cheat.
Let's have a look at the injector first, which - from a pure technical point of view - serves to attach a thread to an external process to run a DLL's routine in it. Since there are a lot of hidden viruses running in these processes, many virus scanners notify them as a virus. Actually, the majority of viruses in this board are bound to the cheat's injector (which means that the virus is ran at the same time you start the program it was bound to). To avoid this, it's best to use always the very same injector, I e.g. always use "PerX" or "Naeron Injector".
Secondly, it is essential to occupy yourself with the DLL file. A cheat manipulates a process's memory, the particular regions are figured out under the usage of addresses. Programs manipulating memory addresses are often notified as viruses alike, as they feature a related behaviour. Here is an example of a hack including no viruses but reaching a result of 17/43 on Virustotal (DLL packed with VMP): [url=http://www.virustotal.com/file-scan/report.html?id=b5e251347512a44b79f801a04f0dee43040 783c130d9113cf6d1c1764088b4d1-1300391848]CLICK_ME[/url].

[B][U]Encoders & Packers[/U][/B]

Encoders & Packers are often used as apologizes for high results in Virustotal reports. Gone through these apologizes with a fine-tooth comb, they include a element of truth but don't have to be true at all. Encrypting is a possible way to ensure the security of someone's source, to prevent it form getting manipulated under the usage of a HexEditor. Therefore, you encrypt the strings. But encryption can also mean letting a routine looking like some else routine, which is called making "fud" (fud = fully undetected) in the hacking scene. This means that virus scanners are not longer able to find the virus. Virustotalreports with a result of no viruses are rare in the gamehacking scene and often indicate viruses - which are after all encrypted. This topic has to be handled with all due caution, because someone who is able to encrypt viruses is mostly not a newbie.
Packer are used to prevent the unpacking of dlls to ensure the security of the source or at least complicate it. As this usually change wide parts of the dll, packed files are also often notified as viruses.

[B][U]Closing words[/U][/B]

War Rock - what a beautiful game - for cheating. But this only stays nice for the cheater until it doesn't end up in a negative result, such as a virus. Abandoning the mostly unaware user in the jungle of internet hazards can't be the intended objective. So I beg the user to be careful, the coders to become aware of encryption and packing as well as the moderation to suppress the spreading of false facts as happened in "the once marked as important"-topics mentioned.

Discuss.[/quote]