Game Development Community

Malware found: Logger.Agent.ajy in nasmw.exe

by Robin Degen · in Torque Game Engine · 03/06/2007 (6:24 am) · 6 replies

So i installed torque 1.5 from the setup and right away that message popped up. Anyone else having this?
I got a new version here: http://sourceforge.net/project/showfiles.php?group_id=6208&package_id=47034&release_id=298515

and that one was fine.

#1
03/06/2007 (7:09 am)
Many malware programs use NASM because it is a free assembler. The one included with 1.5 is fine, but is tagged because other, malicious, programs often use it and include it.
#2
03/06/2007 (8:49 am)
Then why was it fine when i downloaded a new version of sourceforge?
#3
03/06/2007 (9:14 am)
Most likely because the binary signature is newer than your software is looking for (because none of the targeted malware applications are using that version). Most malware/virus detection software cares about the filename only residually (because they are easy to change). The important information is in the signature. Using the name is a simple way to search for known problems.
#4
03/06/2007 (2:21 pm)
Heh that's actually a pretty crappy way of detecting. I just downloaded one of SF to be safe. I can only recommend others to do the same, you'll never know. I'm not saying it's garage games ofcourse, but it *might* have slipped in.
#5
03/06/2007 (2:33 pm)
Nope. It's been a common message for quite some time from some malware/virus vendors vendors. Kind of like how AdAware and SpyBot like to aggravate each other.

EDIT:
You should make sure to check the revision log to see what has changed in the various versions of NASM while you're there just in case you need to make some changes.
#6
03/06/2007 (8:16 pm)
Robin,
Well, they could either bog down your machine checking for stuff in the file against "known" patterns...that may not tell you that you actually have malware because it does not know the new malware signature... Or it could flag it and let you start a conversation in a forum that lets you know "why" and be a bit wiser for it.

I would rather have a faster scan that does not give me a false sense of security.