Black Wyrm Lair Unsafe? (False positives)

Remove all ads!

Not sure if this should be here, Techno-Magic, or elsewhere.

I occasionally pop in to BWL. This is the second time my anti-virus is telling me the site is unsafe. Here is the report:

http://safeweb.norton.com/report/show?url=blackwyrmlair.net

It lists 6 threats:

(Note: It seems that this Board's software is automatically creating the links to the supposed threats in the quoted section; the threat report is just text without links. I wouldn't advise clicking on the links in the quote.)

Anyone else have this issue?

 

Yeah, I kind of figured that my AV was being overly cautious, but I wasn't sure. I noticed that, shortly afer I posted, Sikret visited the TOB forum, so I'm sure he's looking into it.

 

Thanks, Splunge!

I just sent a PM to Baronius at BWL to look into this case accurately. Do you receive the alarm when you visit the forums or the Dragonshoard download page?

 

The forums. (And I just went there again, and got the same report.)

 

They are all false positives.* (Nonetheless, I removed all the 6 files from BWL, see the later part of this post for explanation. Splunge, the title of this topic is not valid in that question form anymore and may be a little bit "misleading" for vague readers, could you update it somehow to reflect the truth?)

Out of curiosity, I checked one of the files in Virustotal.com (virustotal is a site that checks your file with tens of virus scanners), and it said that exactly the same file was already checked on 14.08.2008 by someone and 11 scanners (from the tens of scanners) indicated trojan matches. Now when I asked the site to re-run its test, only 8 virus scanners found trojan from the tens of scanners it applies. So some scanners actually became more intelligent since then! (Or there is some other reason, but the point remains the same: they are false positive.)

No matter that they are false positives, for too careful and/or not well-informed visitors, it can be "frightening", so I removed all the six files. In details, I did the following:

- Secret of Bonehill (2 false positives) is not a BWL mod, and I'm sure it is available at other places too
- Dark side and Northern tales of the Sword coast (3 false positives) was moved to another host for the time being, and I only link to it on DHDC. Hopefully this will prevent norton from "catching" them.
- Song and Silence from Gibberlings3 was removed, along with all other Gibberlings3 mods. They informed us very long ago that they don't need our DHDC mirror, but the Council member who was responsible for DHDC (dragon_lord) wanted to keep them (and G3 gave their consent to him).


***NOTE*** The norton website used by Splunge caches the results, so if you rerun the test now, it will still show the 6 ""trojan threats"! Once its data will get updated, these matches should disappear.

---

*As Taluntain also pointed out, in certain cases it's really hard to make a difference between malicious code and harmless code. It is a certain type of executable code in the current case (the exe file in the compressed rar archive of the mod), and everyone can imagine the virus scanner's hard job: decide whether a code is harmless to your system, i.e. guessing what the code would do without actually executing it. And to do all this in an efficient way: obviously, the online check does not use some resource-intensive, advanced heuristics.

 

It's perfect in this way, that 'false positives' was added.

I would normally agree with your argument (topics evolve with time, and the initial question can get an answer, and the topic title should not be updated), but this is not about a game problem or local problem, it is about a global website that has lots of visitors. As you also know, too careful people might avoid something even due to the suspicion of something unsafe. I didn't want that people who just take a look at the title but miss the topic for some reason might be under wrong impression.

Thanks for changing the title, anyway.