This isn't exactly a programming question or problem, but I've used programming in some respects to solve it anyways, yet it doesn't entirely fix the problem. When I have any hash file exe for any client, after a certain (completely random) time it increases the file size by about 17kb and when later retrying to use these hash files, the check revision fails. Now it doesn't just happen with a bot, my starcraft.exe that's installed also has the same problem. If it's open, it can't change the file size, so I came up with the idea that by opening the exe hash file for binary, it's open and whatever is changing it, can't change it. But that still is a waste of time and resources. Has anyone had this problem or could recomend a solution?
virus?
get the cleaner www.moosoft.com best program i have used may i also recommend buying nortan 2004 and maybe getting bitdefender
Damn...
If its not a virus i would suggest calling blizzard and asking them about it maybe its a glitch or something that affects your type of computer
The cleaner turned up absoluetly nothing
does it happen to other files, or just blizzard games? And is it all blizzard games?
I would suspect that you have some program on your computer (not even a virus, I'd suspect) that is trying to help you by changing the file. I would suggest .. I don't know what to suggest. Perhaps a format :)
Like i said before call blizzard up. if they cant help you then reformat may be a good idea or u could serch google for tauscan another really good virus program and maybe get a reg cleaner thats about all i can think off that may help you.
iago: It has happened to other files but not on a regular basis or like every 10 minutes, like my VB and C++ project files if they aren't open SOMETIMES become corrupt and half the binary is changed. Not all blizzard games just Starcraft, Diablo II and Warcraft II BNE.
Also about it being a program changing it, it would most likely have to be specific towards Blizzard exes. I also constantly check my running processes, if I'm not using it, I close it off. On average I have a total of 16 processes running, most of which are system specific, and others such as AIM and bots.
Quote from: PiaNKA on November 02, 2003, 09:48 AM
iago: It has happened to other files but not on a regular basis or like every 10 minutes, like my VB and C++ project files if they aren't oapen SOMETIMES become corrupt and half the binary is changed. Not all blizzard games just Starcraft, Diablo II and Warcraft II BNE.
Also about it being a program changing it, it would most likely have to be specific towards Blizzard exes. I also constantly check my running processes, if I'm not using it, I close it off. On average I have a total of 16 processes running, most of which are system specific, and others such as AIM and bots.
That doesn't really tell you much. There are a number of techniques that could allow a virus to run in some other process, or even not show up as a process at all (e.g. kernel mode driver).
Quote from: Skywing on November 02, 2003, 11:32 AM
Quote from: PiaNKA on November 02, 2003, 09:48 AM
iago: It has happened to other files but not on a regular basis or like every 10 minutes, like my VB and C++ project files if they aren't oapen SOMETIMES become corrupt and half the binary is changed. Not all blizzard games just Starcraft, Diablo II and Warcraft II BNE.
Also about it being a program changing it, it would most likely have to be specific towards Blizzard exes. I also constantly check my running processes, if I'm not using it, I close it off. On average I have a total of 16 processes running, most of which are system specific, and others such as AIM and bots.
That doesn't really tell you much. There are a number of techniques that could allow a virus to run in some other process, or even not show up as a process at all (e.g. kernel mode driver).
I've never seen a virus that could do that. Well, I guess there's a reason for that.
I still doubt it's a virus, though.
Quote from: iago on November 02, 2003, 05:29 PM
Quote from: Skywing on November 02, 2003, 11:32 AM
Quote from: PiaNKA on November 02, 2003, 09:48 AM
iago: It has happened to other files but not on a regular basis or like every 10 minutes, like my VB and C++ project files if they aren't oapen SOMETIMES become corrupt and half the binary is changed. Not all blizzard games just Starcraft, Diablo II and Warcraft II BNE.
Also about it being a program changing it, it would most likely have to be specific towards Blizzard exes. I also constantly check my running processes, if I'm not using it, I close it off. On average I have a total of 16 processes running, most of which are system specific, and others such as AIM and bots.
That doesn't really tell you much. There are a number of techniques that could allow a virus to run in some other process, or even not show up as a process at all (e.g. kernel mode driver).
I've never seen a virus that could do that. Well, I guess there's a reason for that.
I still doubt it's a virus, though.
You've never seen a virus that infects other program executables with itself so that when those programs are run, the virus is also run?
I've seen one that overwrites programs with itself, but that's it :)
Quote from: iago on November 03, 2003, 02:29 AM
I've seen one that overwrites programs with itself, but that's it :)
A fairly common tactic is to extend .text or add a new section, and rewrite the entrypoint field to point to where the virus code is stored. The virus can then do whatever (e.g. creating a new thread to do it's work, or doing it's work directly) before the original program runs.
I guess now that I think about it, associating .exe's with itself sort've does what you're talking about, but it would still show up on the process list.
I'm not arguing with what you're saying, though, it does sound like a very possible and clever way of implementing a virus; I've just never seen or heard of anybody do it before.
Quote from: iago on November 03, 2003, 08:52 AM
I guess now that I think about it, associating .exe's with itself sort've does what you're talking about, but it would still show up on the process list.
I'm not arguing with what you're saying, though, it does sound like a very possible and clever way of implementing a virus; I've just never seen or heard of anybody do it before.
That's fairly surprising, I think - I've always thought the classic virus was something that infected other programs.
Note that the statement which you originally replied to was:
"That doesn't really tell you much. There are a number of techniques that could
allow a virus to run in some other process,
or even not show up as a process at all (e.g. kernel mode driver)."
In particular, meaning that the virus would not necessarily have to have it's own dedicated process to function. It could, for instance, be running in explorer.exe, along with the "real" explorer.
I guess the problem is that I haven't had a lot of experience with viruses in general. I've only actually seen one, and it was written in VBScript and didn't do much other than change, say, *.mp3 to *.mp3.exe, and replace it with itself.
Quote from: iago on November 03, 2003, 12:38 PM
I guess the problem is that I haven't had a lot of experience with viruses in general. I've only actually seen one, and it was written in VBScript and didn't do much other than change, say, *.mp3 to *.mp3.exe, and replace it with itself.
Arent most birus ment to spead throw out the web so that they can damage more then one computer?
Quote from: -MichaeL- on November 03, 2003, 02:00 PM
Quote from: iago on November 03, 2003, 12:38 PM
I guess the problem is that I haven't had a lot of experience with viruses in general. I've only actually seen one, and it was written in VBScript and didn't do much other than change, say, *.mp3 to *.mp3.exe, and replace it with itself.
Arent most birus ment to spead throw out the web so that they can damage more then one computer?
No. Those are worms.
Virii replicate themselves, by definition, not necessarely spread to different computers.
Virii typically infect files or boot sectors and require user interaction to be started. Trojans typically don't modify other files, rather just send themselves out in multiple copies. Worms typically spread themselves noninteractively so they can infect a large number of computers even if the operators are sleeping.
Quote from: Adron on November 04, 2003, 04:38 PM
Virii typically infect files or boot sectors and require user interaction to be started. Trojans typically don't modify other files, rather just send themselves out in multiple copies. Worms typically spread themselves noninteractively so they can infect a large number of computers even if the operators are sleeping.
So if the operators stay awake, they're safe! So lots of coffee = no worms!
Quote from: iago on November 04, 2003, 05:04 PM
Quote from: Adron on November 04, 2003, 04:38 PM
even if the operators are sleeping.
So if the operators stay awake, they're safe! So lots of coffee = no worms!
even !=
only