Possible malware inside zps.exe (ZPS 3.1 Beta 5)

[|{sT}| SuperConker v4.0]

There appears to be a malware inside zps.exe for the new beta.

Out of nowhere my game crashed and it said my Steam Ticket had been canceled.

After that ZPS would not start anymore, and Windows Defender said Threat Found,
and would not let me run the game at all.

Verifying game cache files would give an error saying "Content File Locked"


Only workaround was to allow the malware, in order to run ZPS (which doesn't seem safe).


https://imgur.com/a/BcCCfjP

[NeoAssassin]

Some files have been encrypted for security purposes. As a result of this, these files seem to trigger a false positive with Antivirus programs because it detects similar characteristics that it has seen in other malicious files. But we can assure you that these are false positives, and there is nothing malicious contained in these files. (I experience this myself with Norton Antivirus.)

Being cautious isn't a bad thing, though - so if you don't trust the files, keep them quarantined/deleted. Our Programmers could explain this better than I could, though.

[|{sT}| SuperConker v4.0]

It was only the zps.exe file though, never seen that before (not even under Beta 4).

I had been playing for hours, then it just randomly happened while in-game.

[NeoAssassin]

This encryption was not included in any previous versions, this is new with Beta 5.

I assume it randomly happened at that time because that was likely the time your Antivirus decided to scan it.

[|{sT}| SuperConker v4.0]

I copied the zps.exe i was having trouble with to another computer, and it gets detected as a malware by Malware Bytes as-well.

This computer also has ZPS 3.1 Beta 5 installed, and it's directory is clean according to Malware Bytes.

Not really sure what to make of that. 2 seemingly identical .exe files, gets detected differently.

https://imgur.com/a/WeaoZFJ

[Shepard]

The executable has been encrypted for security purposes, the problem is that a lot of AV are detecting that encryption as malware even if there is no suspicious code.

I'm gonna send a support ticket to the concerned AVs to report a false positive. If they don't cooperate, we'll have to remove that encryption.

[|{sT}| SuperConker v4.0]

Looks like the Hotfix released today have fixed the issue.

None of my AV's detects zps.exe as a malware anymore.