Cheat Engine

++METHOS

For some reason, my latest trainer is being flagged for having Malware. The only thing I've done differently is incorporate an LUA script for buttons/text boxes.

As a test, I've scanned all of my older trainers, my tables and even my entire CE directory - all clean.

Is there any way to fix this? Why is this happening?

Thanks.

mgr.inz.Player · Posted: Tue Feb 25, 2014 9:05 am Post subject:

Why? For the same reason CE is flagged as suspicious:
http://forum.cheatengine.org/viewtopic.php?t=24363

Generated EXE trainer is in fact:

- SFX module standalonephase1.dat - https://www.virustotal.com/file/88bb94c3ce727db13b77abdbdb75a4c878e91d651692f3618178dec5bbb7080c/analysis/1393336003/

- decompressor module standalonephase2.dat - https://www.virustotal.com/file/65cbed2e8db313b8966638e40eb27f94156c294eb060b28a02c130d146518c39/analysis/1393336581/

- Archive file which contains:

- main CE executable -
https://www.virustotal.com/file/bf25b6c415673b3797572b7e57688278f72dbd69836aca38dced83b6e3045aae/analysis/1393335936/
- Lua dll file
- dbghelp.dll
- defines.lua

Generated EXE (standalonephase1.dat) will contain other files. It doesn't matter if you used Lua or not.
Every time files will be the same, except Archive file and final EXE (which is standalonephase1 with embedded data)

Anti-virus heuristics can cause false-positive.

Try different compression:

or release it as CETRAINER.

Or, you have infected system.

++METHOS · Posted: Tue Feb 25, 2014 9:23 am Post subject:

Yes, I understand how/why the AV would flag it as a false positive...I was just curious as to why it happened this time and never before. I sent you those tables...if you generate a trainer from that, you will see, I'm sure.

I can only assume that the added LUA caused it. It is rather unfortunate, but nothing to do about it, I suppose.

Thanks.

mgr.inz.Player · Posted: Tue Feb 25, 2014 9:37 am Post subject:

"I can only assume that the added LUA caused it"
Probably not. Creating EXE trainer will embed CETRAINER (encrypted). If you use Lua or nor, it doesn't matter. There is always CETRAINER inside cheat engine standalone EXE trainer.

I created EXE trainer based on your CT:
https://www.virustotal.com/file/57e22f3b90335bb179b080c9c15a11ea9701ab49ea85e98efa58fbfecd3c363b/analysis/1393337303/

Agnitum - HackTool.CheatEngine!h2lP7QG9eRI - good,
ESET-NOD32 - a variant of Win32/HackTool.CheatEngine.AF - great

Antiy-AVL - Trojan/Win32.Tgenic - bullshit
Jiangmin - TrojanDropper.Injector.bhlg - bullshit
VBA32 - Hoax.Blocker - bullshit

standalonephase1.exe SFX module works somewhat like UPX. There are many false positive alarms. Even when you write harmless program in C++, if you UPX it, or MPRESS it, some anti-virus will flag it as suspicious software.

EDIT:
The very same CT file used, but this time I used compression method: "fastest"

https://www.virustotal.com/file/927a0ffc23c68076ce97767bea7acf1fe88c1367b61be64eb9052892e95e7268/analysis/

Now "Antiy-AVL" doesn't detect anything.

Conclusion:
1. Some anti-viruses are stupid.
2. you need a place for you generated EXE trainers, or downloaded trainers. That place must be added to exclude list (antivirus advanced settings)
3. download trainer only from trusted sites
4. you want less false positive, report it. like I reported it here:
http://forum.avast.com/index.php?topic=122579.0
(if you are interested only in "how EXE trainers are made", you can read it too)

++METHOS · Posted: Tue Feb 25, 2014 9:52 am Post subject:

Thanks, mgr.inz.Player.

I agree. It is strange that it would happen this time and never before...however, given the fact that the compression type is producing different results, it is not so surprising.

Good catch.

I am actually in the process now of (trying...really trying) to add it to my exclusions list. If this doesn't work, I will do as you say and report it. Worst case, I'll do as you say and designate a folder for this type of thing...although, if I can't assign a file to the exceptions list, I may not be able to add a directory either.

Thanks, again.

mgr.inz.Player · Posted: Tue Feb 25, 2014 10:10 am Post subject:

"given the fact that the compression type is producing different results, it is not so surprising."

Most good anti-viruses have build-in zlib decompression module.

In my case, Avast will grab embedded data (RCData) from trainer main EXE (standalonephase1.dat with RCData):

- DECOMPRESSOR (which in fact is standalonephase2.dat)
After launching trainer, saved in TEMP directory as exe file with the same name as trainer main EXE - Avast analyzes it, nothing found.

- ARCHIVE (it is zlib archive, compression levels: none, fastest, normal, max)
After launching trainer, saved in TEMP directory as CET_Archive.dat - Avast decompress that zlib stream, nothing found

DECOMPRESSOR decompresses ARCHIVE (extraction to another folder in temp). There will be: ce exe file (cheatengine-i386.exe or cheatengine-x86_64.exe) with the same name as decompressor and trainer main EXE; dll files; define.lua file; cetrainer file ( CET_TRAINER.CETRAINER ).

then DECOMPRESSOR will launch ce exe.

ce exe automatically loads CET_TRAINER.CETRAINER and deletes it.

You can use Resource Editor software to see those:

Rydian · Posted: Wed Feb 26, 2014 12:22 am Post subject:

I started finalizing trainers with no compression a while ago because some specific AVs just flip their shit.

"I can't see it? IT'S BAD."

Which of course stops users with stuff like Norton from even downloading the trainer.

++METHOS · Posted: Wed Feb 26, 2014 12:59 am Post subject:

Yes...I think I will start doing the same.

mgr.inz.Player · Posted: Wed Feb 26, 2014 9:08 am Post subject:

I reported false-positive
http://forum.avast.com/index.php?topic=122579.msg1066556#msg1066556

You can do the same. (for other AV)

++METHOS · Posted: Wed Feb 26, 2014 2:04 pm Post subject:

Thanks. I'm glad you did that, because I was too impatient (too busy) to fill out all of that nonsense. Avast should change their reporting system.

Update:
Avast has updated their database due to mgr.inz.Player's report, removing CE files from their blacklist (for now). Good work!

STN · Posted: Sat Mar 01, 2014 7:22 am Post subject:

Its unfortunate. Most antivirus companies release incompetent bull$hit antivirus products that can't detect malware for shit. No actual malware uses those methods commonly in use by trainers to spread crap anymore but AV companies will still mark it as virus without actually looking at the data.

I don't use any AV at all, even have disabled the windows essential thing and i haven't got infected for years now. If you know what you are doing you don't need an AV but even an av can't save you if you are a noobie and clueless to what is a safe source to get things from and what is not.

BTW, reporting to those AV companies is pretty useless as they just add an exclusion to the trainer you sent them, they still detect others as malware.

mgr.inz.Player · Posted: Sat Mar 01, 2014 8:14 am Post subject:

"BTW, reporting to those AV companies is pretty useless as they just add an exclusion to the trainer you sent them, they still detect others as malware."

In this case, I mean Avast, at least trainers made with CE6.3 will work Very Happy

Rydian · Posted: Sat Mar 01, 2014 2:18 pm Post subject:

STN · Posted: Sat Mar 01, 2014 4:50 pm Post subject:

Hatschi · Posted: Sat Mar 01, 2014 4:56 pm Post subject:

All you need is a strong firewall because nowadays only trojans are being coded. No one is interested in making a virus or worm anymore.

STN is mostly right, however telling someone only brain.exe is necessary is bullshit, I'm sorry to say. There are several exploits uses javascript on websites as an example and hackers even inject website on normal sites. So an AV is still recommended, but it's not a 100% valid solution.