Thursday, June 24, 2004

PC Game Triggered False Virus Alert

Note:  the following is diary of a series of events that occurred after an antivirus update on my computer.  This issue was resolved in a timely manner by Oberon Media and McAfee.  If something like this should happen to you, contact the software and antivirus companies involved to see if the alert may be in error.

Last night around 9:20 PM EST, my antivirus program McAfee had an update that required I restart my computer. When I restarted my computer, it alerted me that a file called gutterball.exe was infected with W32/Gaobot.worm.gen.e.

Gutterball.exe is the file that opens up the game Gutterball 3D, a 3D bowling game offered by IncrediGames, Oberon Media, and Skunk Studios LTD. IncrediGames is an offshoot of Incredimail, LTD.

The file sizes of the Gutterball installation files were different. The file size from the Oberon Media location was 7850 KB, the IncrediGames location was 7779 KB, and the Skunk Studio location was 6998 KB. I downloaded the installation file from Oberon Media and IncrediGames, and both times McAfee alerted me to the same infection and deleted the gutterball.exe file. However, when I installed the game downloaded from Skunk Studios, McAfee didn't detect any viruses, worms, nor trojans. I find this very interesting!

I retrieved the e-mail receipt from my files. I purchased this game from the IncrediGame web site, but the receipt came from Oberon Media. I have written Oberon Media expressing my displeasure and have asked for a refund. I promised an update as soon as I got some information.


UPDATE: 6/24/2004 6:20 PM EST

I received my first response from Oberon Media. The entire e-mail is as follows:

-----------------------------------------------
Below is the answer to the question you recently sent to the Oberon Media Support Team. If this response does not answer your question please use the link to update your question so we can take another look into this incident for you.


Almog Flitter 6/24/2004 9:44:50 AM
Dear customer,

We checked this issue several times as seriously as possible, and confirmed that our system is indeed virus free.
From time to time anti-virus companies publish false alerts. We suspect this is the case and are waiting for Mcafee to fix their definitions. We expect that soon, probably today. As soon as it comes, we will send it to you so you can enjoy our games to the fullest!


Once again, I would like to assure you that our system is safe and protected, and that no harm was caused to your computer by our games.


Thanks,

Almog Flitter,
Oberon-Media
--------------------------------------------

This still does not answer the question about why there are three different file sizes for the same game. However, I have to give them credit for giving me a timely response. My antivirus program just had another update, so we'll see. I will update as I get more information.

Update: June 25, 2004 12:20 AM

I received a second response from Oberon Media, confirming that McAfee made an error. I checked the virus info page on the McAfee web site, and, indeed, the update concerning this situation had been issued.

The entire e-mail received is as follows:

-----------------------------------------------------
Below is the answer to the question you recently sent to the Oberon Media Support Team. If this response does not answer your question please use the link to update your question so we can take another look into this incident for you.

Alon Hod 6/24/2004 8:08:13 PM
Dear customer,

Mcafee just released the following:

"An incorrect identification of some modified ASPacked files as W32/Gaobot.worm.gen.e has been identified in the 4368 DAT files. The 4369 DAT files are being released to resolve this incorrect identification."
(http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=101447)

The game may just work now.
If not, an update of Mcafee should solve the issue or you can update by download the 4369 DAT file from:

http://www.networkassociates.com/us/downloads/updates/dat_download.asp


It's clear Mcafee had a mistake here. As you can see we did our best to fix the problem and make sure you'll be able to enjoy your games as soon as possible!

If the game still doesn't work, just enter the original website you downloaded the game from.

Find your game and click Download, no need to purchase again, if you get limited time play, use your registration key we sent you in the confirmation letter.


Please don't hesitate to contact us at any problem, we will be happy to assist you a always.


Enjoy,

Alon Hod
Oberon-Media
---------------------------------------------

I did respond to let them know that I have received their information and that I appreciated the timely responses and solution to my situation.

My confidence has been restored in the company, and I have reinstalled the game and have been happily playing it.

No comments: