just got a virus warning from GTA IV Complete edtion download folder

[mft]

D:\SteamLibrary\steamapps\downloading\12210\GTAIV\pc\data\maps\props\commercial\clothes.img
Trojan:Win32/CryptInject!ml
RAT Trojan

Is my PC acting up or is the download ratted?

[Yujah]

False positive. You may whitelist.

[mft]

Originally posted by Yujah:

False positive. You may whitelist.

I figured, still made me crap my pants cause RATS are the worst possible you can get.

[Kurosu]

Had the exact same as well. First time it ever happened withing 10 years of steam ussage.
Even as a false positive its very weird. False positives are common when you pirate games, NOT when you download them through steam.

I also found posts 1 month old with the same issue. I guess rockstar doesnt care since its not gta V online?

My advise is to delete it just to be safe.

[bullmatrix]

I got 2, both are from random tiny game files. Very weird.

[ant_sh]

Originally posted by Kurosu:

My advise is to delete it just to be safe.

Somehow byte sequence in this data file resembles the one of a known virus. It is just a coincidence.

Deleting any .img files from GTAIV subfolders is a very bad idea. Do not touch it.

[uHKBu3uToP]

I can say the game is completely safe. I don't know what could have caused it.

[WillieSea]

In another thread, it is suspected that there are world region differences between files.

Since the file size my game shows, and the other person with the virus signature and the file size is different.

So, that might explain why not everyone gets the virus warning.

But then, it might also be a virus infecting the file to hide itself when the game is downloaded.

You decide.

[Kurosu]

Originally posted by ant_sh:

Originally posted by Kurosu:

My advise is to delete it just to be safe.

Somehow byte sequence in this data file resembles the one of a known virus. It is just a coincidence.

Deleting any .img files from GTAIV subfolders is a very bad idea. Do not touch it.

I meant to delete the entire game. A reddit post from November reported multiple files with the virus warning . ALL were false positive?

[Yujah]

Yes.

[Kurosu]

Sure thing budyy ^.^

After all this is a very common incident on steam downloads.Oh wait.....

[Yujah]

This stuff really isn't all that difficult. It is obviously fully unsurprising that files from one given game can have a sort of signature themselves; an over multiple files repeated pattern or even actual byte sequence. Should said pattern now by pure chance resemble a pattern/sequence as found in an existing virus we're at the observed result.

As stated before on this forum, with both ever growing numbers of (short enough) virus signatures and ever growing disk sizes (my own game data disk holds approximately 2.500.000.000.000 bytes currently) it easily becomes a mathematical practical certainty that one or more false positives happen.

Moreover a few times, Steam checksums files so if it feels a file valid you know that it's the same as how said file exists on the Steam servers. Which is to say you are by deleting the game at that point defending against the Steam servers being infected. If you feel that worth it do also be sure to walk in zigzag patterns on the street to dodge meteors.

I've been in this same conversation a lot and, yes, I know above will not convince you. Because security, hacker, cool, responsible, yadayada. As also said before, good luck with that; the rest of us will be off playing GTA4 in the mean time.

[Kurosu]

Short summary : the multiple posts about virus warning from a client that never encoutners similar issues to ANY other game are all fake , please take my on my word because I claim experience and play the game despite the numerous posts that reported virus warnings.

And you are closing your comment by trying to make me jealous of...GTA 4? I have finished it 5 times already. This is an old game.

[Yujah]

I was in fact quite explicit about not needing to take my word for it, but being able to rely on objective mathematics both as to probability calculus and as to checksum algorithms --- and on your copy of Windows Defender being rather unlikely to best Steam's own measures.

As said though. Yadayada. Best of luck :)

[ant_sh]

Get SparkIV, open clothes.img in it. If it opens and shows Perseus jackets and shoes then it is a false pisitive, if it doesn't then it is a TROJAN!!!