Playonline Virus (Mcafee FALSE POSITIVE)

[Marihoki]

I used to have NOD32 on both of my computers (my desktop and laptop) but it lagged my laptop horribly whenever I played Final Fantasy XI. Someone Recommended Kaspersky to me so I tried it on my laptop and it took away my lag problem. I'm not really an expert on anti virus software but I heard these are both really good and really reliable. At the moment I'm using both programs (NOD32 on my desktop and the other on my laptop) since I paid for a year of NOD32 on both computers but am planning when the subscription runs out to stick with Kaspersky. Just a little heads up if your planning to get ESET and are playing FFXI.

[Mistress Stowastiq]

Got this yesterday but mine wasn't a POL registry. It happened right after I jumped on to wiki for some reason and Windows Virus scanner (I don't use the thing so I don't know why it suddenly started working) just started going off about infected files. I carefully navigated through about 4 or 5 popup windows that asked me if I wanted to clean these files and went with my instincts to trust my own virus scan stuff (McAfee). The registry log after the scan pulled up one infected file that looked like: BRCOUYDC.DEFAULT/CACHE, the items scanned were called FakeAlert-GreenAV (trojan).
Maybe a fake alert virus implanted in to your systems natural virus scan software to get you to click things? I sent the analysis off to McAfee so they can take a look at the logs and said they'll get back to me. Wiki problems anyone? No problems with FFXI or anything else as I can tell.

Neph, though I might be wrong I don't want to read this entire thread again to find out. I do not recall this false positive having anything to do with wiki. This issue iirc was, after a Mcafee update, POL files were giving Mcafee false positive msgs when pol starts. Mcafee apparently patched the issue later on.

If you are not absolutely certain that the pop ups were from your virus scan client:
Check your virus scanner company and make sure those pop ups belonged to them and were not fake phishing ads attempting to get you to close them with a click. Most companies provide some sort of information as to the specific type of messages their client will generate. You can also choose in your virus scan client for its specific settings on which messages will actually pop up or will not.

Perhaps a screenshot of the popups you got would lead others here on helping you identify them also.
Good luck.

[Nephlite]

Hadn't thought about the screenshot while it was happening but that's a good idea nonetheless. I don't recall having updated it (McAfee) recently because I have it set to notify me before doing an update (mainly cause when i'm running FFXI and it started updating it'd slow FFXI up and cause me to desynch in to the ground). Which is why I took the time to ask if anyone recalled having navigated through Wiki or something of the sort before then? The problem is I don't have Windows Virus Scan enabled which led me to believe it was some sort of phishing tool that was masked to look like the virus scan software (your idea). I'm gonna try to research it a bit in the morning and will try to take some screenshots to show what it did but basically when I navigated through the pages closing them, a windows error message would pop up saying "Error, your machine is infected. Slowing of your machine will now occur." The McAfee thing might just be a coincidence but it hasn't shown me any errors so far.

The infected file again had nothing to do with any registry file in PoL as far as i'm aware, this might just be an incredible coincidence and I got a totally different error that has nothing to do with the topic. I just read through a lot of it and thought the problem was similar. Time to make some phone calls >.<

[Hoshiku]

Just a little heads up if your planning to get ESET and are playing FFXI.

I use NOD32 on both my desktop and my laptop and am able to play FFXI on both with no trouble whatsoever.

[Mistress Stowastiq]

Hadn't thought about the screenshot while it was happening but that's a good idea nonetheless. I don't recall having updated it (McAfee) recently because I have it set to notify me before doing an update (mainly cause when i'm running FFXI and it started updating it'd slow FFXI up and cause me to desynch in to the ground). Which is why I took the time to ask if anyone recalled having navigated through Wiki or something of the sort before then? The problem is I don't have Windows Virus Scan enabled which led me to believe it was some sort of phishing tool that was masked to look like the virus scan software (your idea). I'm gonna try to research it a bit in the morning and will try to take some screenshots to show what it did but basically when I navigated through the pages closing them, a windows error message would pop up saying "Error, your machine is infected. Slowing of your machine will now occur." The McAfee thing might just be a coincidence but it hasn't shown me any errors so far.

The infected file again had nothing to do with any registry file in PoL as far as i'm aware, this might just be an incredible coincidence and I got a totally different error that has nothing to do with the topic. I just read through a lot of it and thought the problem was similar. Time to make some phone calls >.<

Is your account doing fine? I hope I am not freaking you out or over warning you.
I am pretty sure this thread said that the mcaffe problem was do to a post update conflict. If you have your scans turned off, it might help to at least allow windows (if you know how to) update and your virus scan program update while you are out of the game.

This and the player with token hacked thread have very elaborate instructions on how to scan your computer for viruses. Also there is a sticky on BG regarding arming and protecting your computer. Check our the player with token hacked thread for posting your screenshots of the popup also.

http://www.bluegartr.com/forum/80487...ked-lolie.html

http://www.bluegartr.com/forum/78291...s-malware.html


I am uncertain of a virus scan message that tells you your machine will be slow because of an infection. Usually they ask you permission to quarantine or ignore, or other instructions regarding handling the virus, not statements on how the virus will annoy you. Spam and malicious popups tend to say things to frighten or entice you into clicking, thinking you are helping things. Windows update will tell you it is going to continue in the background while you work, though I am unfamiliar with win 7 or vista's update msg.

The info in the popup should have trademark for your virus scan software on it and possibly a number/link for reporting the type of virus to the provider of the virus scanner. I am not saying you should click on it unless you are absolutely certain that you can tell the difference between malware popups, your viruscan program and windows official system popups.

[Kaibelf]

Did the German's give us an inch when they bombed Pearl Harbor? Hell no!

I assume you mean the Japanese?

What's next? Accusing the Haitians of 9/11?

[cdgreg]

I assume you mean the Japanese?

What's next? Accusing the Haitians of 9/11?

=\

[Marihoki]

I use NOD32 on both my desktop and my laptop and am able to play FFXI on both with no trouble whatsoever.

I had two different laptops. My first one ran NOD32 completely fine but then I accidentally spilled soda on it >_> and it was 2-3 years old so I just got a new one. The new one I got completely screwed up when I used FFXI + NOD32 at the same time. It would cause my char on FFXI to have a lag spike every 5 seconds. I'm not sure exactly what was causing it, but changing from NOD32 to kaspersky completely fixed it.

[TaruMortis]

I assume you mean the Japanese?

What's next? Accusing the Haitians of 9/11?

Holy shit, I even posted a link referencing what he was talking about.