FCEU trojan virus???

[midevil.chaos]

I had an oooooold NES emulator, called FCEU. In any case, on this pc, I installed Threatfire which detected my FCEU emu (version .98.12) as trojan virus:

Trojan.DR.Agent.EQBF


What the heck???

So, I uploaded the file via virustotal... and lo and behold 8 antiviruses detected a trojan. So, please take a look at the logs and lemme know your thoughts on this matter. Even malwarebytes didn't detect anything (not that MBAM is very good imho).



HERE is the virustotal log

https://www.virustotal.com/file/ce96...is/1341362804/



HERE is the threatexpert log:
http://www.threatexpert.com/report.a...b93fd9e1df3f88


(the preocedures seem normal to me, I mean the created folders and stuff. Except maybe this part:

"""DirectSound Administrator shared thread array (lock)"""

).

[MaslowK]

First question is, where did you download the particular copy you have? If it wasn't from a trusted source it's possible it's had malware packaged in with the main executable or its included components. It's also possible that, if you have an older version, that it was falsely labeled as malware. I'll also note that when googling "FCEU" every result on the first page references it as "FCEUX", furthering the thought that the copy you have isn't legitimate.

That said, I'd recommend simply deleting the copy you have and downloading the latest version from the official website, which can be found here; http://sourceforge.net/projects/fceu...2.zip/download

I've downloaded this particular copy and run it through VirusTotal as well as Jotti; neither found any part of the archive to be malware.

[midevil.chaos]

I see. I cannot recall where I got the copy from. Unfortunately, it was many years ago. Yet, I am surprised MBAM, superantispyware and my own antivirus did not detect the trojan Thank God Threatfire did! It had already saved me twice from trojans lol (wait, probably from the same .exe file... lol).

Also, what scares me is that it was in my antivirus' security network, used by more than 10k pps...

All I do know is that I got it from www.fceultra.html (I guess that would translate to .com, but I'm not gonna test the site lol).

[MaslowK]

Well, www.fceultra.com doesn't take me anywhere, and google returns no results for said domain so I'm assuming if it did exist, it doesn't anymore.

However I did manage to find a copy of an "FCEU" on zophar.net which happened to be the same copy you scanned earlier (same SHA256 hash), and of course, came up with the same scan results. Still, further testing would be required to tell if this particular file is in fact infected or is simply picked up as a false positive; maybe due to the method the version uses to write configuration files or something similar (purely speculation).

In any case I would just use the copy I posted in the sourceforge link, if only to use a more updated emulator.

[midevil.chaos]

Oops, I contradicted myself lol. I meant to say, I have a file (html) called fceultra. Which does NOT mean anything, since it's merely an html file. I assume I got it from zophar's domain.

So, perhaps that site became non-existent after a while. Who knows what happened...


Would you like me to send you my html file from 2004? It'll be a local file since it's html. The HTML doesn't seem to have any
<a href> tags with current links. I mean, it only have links with the # sign. So, it would seem impossible to verify the actual source of the document, as it does not appear to have a real pathway (barring local). That and the fact that it's old school HTML...

But, if you wanna take a look at it, I'll send you the HTML file. Maybe I missed something.

[MaslowK]

Sure, could be interesting to look at. You could post the source on pastebin, might make it easier.

[midevil.chaos]

Ah, cool. THAT is a nifty website

If you know of ANY other website that is awesome (maybe with free logos, pictures, and anything to use on a website), lemme know



Here's the link for the pastebin (I put it up for one month, in case we need to go back to it):
http://pastebin.com/JvM1p1dH



Goodnite. I really gotta go to bed.
I'll be interested in knowing whether you find or not something I missed.

[MaslowK]

It would appear the fceultra.html you have is just the documentation included in the .zip file for the emulator; just a set of tables and hyperlinks to sections of said tables, nothing special. It's the same one included in the zip file I downloaded from zophar.

[midevil.chaos]

i know. I was pretty tired yesterday. I know I wasn't explaining things very well lol. Although I was hoping they had an actual url

[MaslowK]

Although I was hoping they had an actual url

They do. I just chose to link you to the file itself instead. Here's their actual url; http://www.fceux.com/web/home.html

[midevil.chaos]

Alright, yet I still don't know what to make of the file.

Strangely, mcafee site advisor lists zophar's site as risky. As for my antivirus, it rates it green. So, maybe something fishy happens on their site at times? I mean, I'm pretty sure i dl'ed it there. Anyhow, I'm glad you gave me a link for the emu on sourceforge.