Just let my antivirus to do full scan my computer (using latest virus signatures)... and it found a virus in Doom 3!

Here are pictures:



and



The same antivirus program was active when I installed Doom 3, and was active whenever I played Doom 3 - and never found nothing (probably beacuse not scanning archives (such as pak002.pk4) beacuse it will hamper PC performance); but now when I did full scan of ALL files + Archives, it found a virus.

* mmmm confused...

must be some kind of addon ... if not ... its just a false detect ...
especially if you look at the file ... its just an animation ... this can't be a virus ... and Kaspersky also did not find any ...
you may update your definitions again and do a second scan ... btw now that the file is removed you may need to reinstall doom or it may crash during play if the file is needed ....

Bit Defender is notorious for finding false virus detections. One of the more interesting things it does is look for names within a file. By names, I mean the signature of the author (whoever wrote it). Apparently a lot of virus writers like to sign their work (somewhat like artists, I guess) and it seems that Bit Defender looks for either specific or symbolic names or combinations of letters/phrases/whatever that matches some huristic pattern.

I used Bit Defender briefly a while back and it kept triggering (false) virus detections on files that I KNOW were not infected. That's why I stopped using it. At least three of the files I looked at (with a HEX editor) had the names of someone (the authors) that were close to the spelling of the author of a REAL virus. I guess it didn't matter that there wasn't any actual code within those files that could cause ANY harm to my system. Just the names of the authors was apparently enough to mark them as bad-guy virus writers. I'd call that very poor programming.

The files in question that it detected as being infected on your system are simply text files (scripts) that are used in creating animation (motion) in objects and characters within the game, just as Mertsch pointed out.

I seriously doubt that there's anyone out there (especially in the virus writing community) who knows the game engine used in Doom 3 well enough to modify an animation script and turn it into some kind of virus that MIGHT delete or infect other files on your system. The whole idea of that is just a bit too far-fetched.

An interesting experiment would be to create or modify a couple of files and add the names (most of which are actually nik-names) of authors of some of the KNOWN viruses. You can get those names from the descriptions of the viruses on sites like Symantec's and others where they give detailed information on what the viruses do (and in most cases, who wrote them).

Then, using a HEX editor, plant the names inside the files and turn Bit Defender loose on them and see what happens. If my theory is correct, it should tell you that the files are infected. Might be fun :o

The opinions and theories expressed herein are not the opinions or theories of management. Should they, however, turn out to be correct, management will take full credit.

Later.