Firewall not liking party + skins, is my computer getting hacked?

[Professor Frink]

Hi , i've been using the party programs for quite a while and last night i loaded up party in the usual way when i got this message from my firewall program (Kaspersky Anti-Hacker)


Attention! The EmpirePoker.exe executable file checksum is modified. Pls. examine the cause of changes: this is probably the version updating, or the file was infected. Check the file, if possible, with your anti-virus.

-> gives the option to block, or continue.



So i blocked it, ran a virus check, nothing found.

I Then tried empire, same message. Pokernow, same message with this skin i allowed it to continue since i had no $$$ in (prob still bad idea i know), and the program seemed to work fine.

Then i uninstalled party, reinstalled a fresh version from the site and i got the same thing.

Anyone having problems like this or just me?

[StellarWind]

ZoneAlarm did the same thing last night for Party and Multi. The last modified dates on the executables are changed to match the time I activated the program.

The firewall is quite correct to bring this to my attention and ask for permission. I don't understand what happened and I am very worried. However the system passed a virus check.

Other executable files in my system including Paradise Poker are not affected.

Some sort of stealth upgrade?

[Professor Frink]

Thanks for the reply Stellar, i was getting very worried that it was just me.

I don't know what they're up to, but a friend told me that they had a server upgrade the other night.

Hopefully is a stealth upgrade to target the [censored] bastards that use bots.

[Lost Wages]

No, my bots are still beating everyone else's bots.

Lost Wages

[Lost Wages]

ZoneAlarm did the same for me today. I don't think it's any cause for concern.

Lost Wages

[Yads]

Probably a false positive. I beleive my anti virus detected pacific poker as being some kind of adware.

[dfscott]

After the server upgrade a day or so ago, I initially couldn't connect. I got taken to the "can't connect" webpage, but it had some additional info about having to reconfigure my firewall. I ignored it, tried again, and everything was fine. However, I think that means that they've definitely changed something in the way they connect, which could be causing the red flag.

[Art Vandelay]

I got the same popup yesterday with Empire, haven't tried Party. Sounds like you're not alone.

[StellarWind]

[ QUOTE ]
Probably a false positive. I beleive my anti virus detected pacific poker as being some kind of adware.

[/ QUOTE ]
It wasn't the antivirus feature. It was the firewall. It's designed to object when a trusted program has been modified since it was last used to access the network.

This is a good feature that prevents (e.g.) your email client from being replaced with a trojan horse that proceeds to email your financial data to criminals.

A common way that executables get changed is a virus copies itself into the program.

If you happened to have upgraded your software recently, you just give the firewall permission to let the new version use the network and everything is fine.

I didn't see any evidence of a legitimate software upgrade by Party. Yet the modified dates on the executables indicated a fresh change. The firewall did exactly what it was supposed to do. My programs were tampered with and the only question is who did it? Had Party gotten too stealthy for its own good? Or did I have a virus in a program that had unfettered network access and my account password? Having the Last Modified time being the same as the time I last started the program practically screams virus because viruses are often installed when a program is launched.

I feel better now that I know others had the same experience. Probably it was something that Party did. But I hate that Party has such a total disregard for security that they think invisible program upgrades are OK. Next time Zone Alarm has a question it might be a real wolf. I can't be in a position of having no clue what Party is up to.