Fenomen-Games.com

[mad_rain]

Hello.

I'm co-owner of Fenomen-Games.com web site. Our site falsely marked as 'red'.

The problem is that we use our Game Downloader which is FALSELY identified as Adware. Our downloader is very similar to downloaders of BigFishGames.com and TryGames.com (they are marked green).

Also, I have contacted SiteAdvisor team a week ago, but without success.

I'm not just asking to recheck the site, I'm asking to analyse our downloader more carefully. I'm able to answer any technical question.

This is very critical for us. Please, help.

Here is an independent blog describing the problem:
http://msbasic.wordpress.com/2008/05/22/fenomen-download-er/

Thank you,
Andrew.

[Jubo]

Did you see this topic: http://community.mcafee.com/showthread.php?t=217274?

[mad_rain]

Sure. But I did get any response from them.

[Raja]

You're barking up the wrong tree. You need to get AVERT to not label your software as a virus or malware.

SA shows 438 'red' downloads. With that many red tags, they're not going to change the rating.

-R-

[mad_rain]

Thank you for reply!

It's the same program. When a user downloads a game he/his get downloader that starts to download the selected game. So we have to add some bytes to exe to let downloader identify what game has been selected for download. That's why checksums are different.

We may try to transfer this data through downloader filename, but still need review in that case when this will be done.

[exbrit]

Can you identify the downloader that is being detected and submit it to Avert labs? If they confirm that it is infected (even falsely) then you should appeal via email immediately.

Send a file to Avert for analysis:
http://vil.nai.com/vil/submit-sample.aspx
or
https://www.webimmune.net/default.asp
or
Email file to: [EMAIL="virus_research@avertlabs.com"]virus_research@avertlabs.com
When submitting samples via E-mail all samples must be packaged in a .ZIP file. When creating this .ZIP file, it is important to understand that the .ZIP can be no more than 3 megabytes in size and can contain no more than 30 files. Additionally, any .ZIP file created must be password-protected using the password "infected" (minus the ""). Failure to follow these guidelines will cause your submission to be rejected.

Getting the downloader cleared is the main problem here.

[mad_rain]

Thank you for this info.

I have submitted downloader by email and got this:

File Name Findings Detection Type Extra
--------------------|------------------------------|----------------------------|------------|-----
downloader3.exe |current detection |downloader-fenomen.gen.a |Application |no

Our analysis detected a potentially unwanted program or joke program with our current
DAT files and engine. It is recommended that you update your DAT and engine files and
scan your computer again.

I don't know what should I do with this.

Best,
Andrew.

[exbrit]

Use the email address above and put the case ID number in the header and explain exactly why you are appealing the finding.

[mad_rain]

I got this strange auto reply:

"Potentially Unwanted Programs are not considered a virus or trojan because they do not self-replicate and they do not damage systems maliciously. Potentially Unwanted Programs detection requires either the command-line scanner (with /PROGRAM) or VirusScan 7 or higher."

If the downloader is green why the site still marked as 'red'. And I never got any replies to my submission to SiteAdvisor User Feedback form.

I have added 'noauto' to subject of the email, hope to get an answer from them.

Thanks for help.

Andrew.

[exbrit]

That is very odd that you got no reply to your feedback form submission. I would try it again.

I just went and downloaded one of your trial games. I too got the warning but I trusted it and it downloaded fine.

Perhaps SiteAdvisor is going a bit far with a red label in this case and should perhaps only be using a cautionary level, if there is such a thing.

I'll flag this for the forum admin and see if he can get someone to look at it.