Tiberian Sun Trojan

Crimsonum · Seth **Joined**: 14 Jul 2005 **Location**: Fineland

I bought a used copy of TS around two weeks ago via eBay. The guy whom I bought and the product seemed perfectly legit, and now that I got the game, it looks fine too. However, once I had it installed and tried to play it, my anti-virus software alarmed me of some trojan called "Renos.gen!Q" in the game.exe. Happens with both CDs. I feel it's unlike that there is actually a trojan, plus my software has done false alarms before. Which should I trust?

_________________

gufu · Posted: Wed Jan 11, 2012 10:19 pm Post subject:

Seems to me like the CDs you've been given are possibly cracked.

But just to be sure, what Anti-Virus are you using?

_________________
DUNK!

Crimsonum · Seth **Joined**: 14 Jul 2005 **Location**: Fineland

gufu wrote:

Seems to me like the CDs you've been given are possibly cracked.

They are the real CDs, no burn copies or anything like that.

gufu wrote:

But just to be sure, what Anti-Virus are you using?

F-secure

_________________

^Rampastein · Rampastring **Joined**: 11 Oct 2008 **Location**: Gensokyo

You could send that Game.exe to them as a possible false-positive and see what they answer.

_________________
CnCNet Client | CnCNet TS patches | More Quality-of-Life Improvements for RA Remastered

Crimsonum · Seth **Joined**: 14 Jul 2005 **Location**: Fineland

I sent it to their sample analysis as false positive, it did spot the trojan at first, but then it showed me green light, saying "Known Clean" (whatever that means?) and "No Detection", so I guess it was a false positive after all.

_________________

Lin Kuei Ominae · Seth **Joined**: 16 Aug 2006 **Location**: Germany

what's the exact filesize of the game.exe?
There are only a limited number of correct sizes and if it contains additional code like a trojan, it will be surely bigger than the usual/known filesizes.

Or simply upload the exe here, so we can check it too.

_________________
SHP Artist of Twisted Insurrection: Nod buildings

Public SHPs
X-Mech Calendar (28 Mechs for GDI and Nod)
5 GDI, 5 Nod, 1 Mutant, 1 Scrin unit, 1 GDI building

Tools
Image Shaper______TMP Shop______C&C Executable Modifier

Crimsonum · Seth **Joined**: 14 Jul 2005 **Location**: Fineland

I thought so, but I already trust it was a false-positive. Exe size is 239 351 b, version 1.08

GAME.rar

Description:

Download

Filename:

GAME.rar

Filesize:

85.69 KB

Downloaded:

11 Time(s)

_________________

Lin Kuei Ominae · Seth **Joined**: 16 Aug 2006 **Location**: Germany

what is that o.O?
I know that the CDs have some kind of compressed game.exe in which you can't find any keys in clear text.
But yours has a bit readable text, so i'm really not sure about this. these compressed exes are also not further compressable, while you managed it to get even smaller in the rar (as if it's only text).

Someone with an original CD should compare them again, as i have no access to the CDs right now.

at least it's completely different to the 1.08 version Hyper posted.

_________________
SHP Artist of Twisted Insurrection: Nod buildings

Public SHPs
X-Mech Calendar (28 Mechs for GDI and Nod)
5 GDI, 5 Nod, 1 Mutant, 1 Scrin unit, 1 GDI building

Tools
Image Shaper______TMP Shop______C&C Executable Modifier

Crimsonum · Seth **Joined**: 14 Jul 2005 **Location**: Fineland

Well yeah, I noticed Hyper's was 3 Mb #Tongue

_________________

Team Black · Posted: Fri Jan 13, 2012 3:11 pm Post subject:

I'm just curious as to why you bought TS in the first place #Tongue

it's freeware you know.. but I'd understand if all you wanted was the discs

_________________
The Fall of Hammerfest - Epic Tiberian chain story

Tiberian Odyssey mapping department. Discord
The Team Black Index

Crimsonum · Seth **Joined**: 14 Jul 2005 **Location**: Fineland

It costed me less than 3 € (+ shipping), and I wanted it for nostalgic reasons. Now I have the box to keep in my showcase #Tongue

_________________

^Rampastein · Rampastring **Joined**: 11 Oct 2008 **Location**: Gensokyo

Lin Kuei Ominae wrote:

what is that o.O?
I know that the CDs have some kind of compressed game.exe in which you can't find any keys in clear text.

The filesize of this EXE is so small that I doubt that it's the real TS executable, but an executable that is used to decrypt and load that compressed real executable.

For more info, check this: http://en.wikipedia.org/wiki/Safedisk#SafeDisc_.28V1.29

Quote:

...
And also by the existence of two files <GAME>.EXE and <GAME>.ICD (where <GAME> is replaced with the actual game's name).

The EXE executable is only a loader which decrypts and loads the protected game executable in the encrypted ICD file.

I can see a GAME.ICD in my TS folder, I guess that Westwood didn't bother updating the copy protection with their patches.

Btw, that EXE doesn't detect my original TS CD as a valid one.. I wonder if there were multiple different versions of it or something.

_________________
CnCNet Client | CnCNet TS patches | More Quality-of-Life Improvements for RA Remastered

Crimsonum · Seth **Joined**: 14 Jul 2005 **Location**: Fineland

Oh, yes, now that you mentioned it, my game.icd is around 3 Mb.

_________________