Help! Kaspersky says Duck Game is a virus!

[CORPTRON]

First off, sorry for the antivirus trouble. Kaspersky (and Zone Alarm, I think) have been flagging Duck Game as a virus.

This is a false positive, the game is not malicious and is certainly not a virus.

I've submitted the file to Kaspersky for re-evaluation and they've confirmed that it is a "false detection", and said they would fix the issue. Unfortunately, unless they change their detection heuristics they will likely need to fix the issue for every new update I release. This will become less of an issue as the time between updates grows, but since I'm still actively working on the game and updating the EXE pretty much every day- I need your help to keep the AV's at bay!

I'd greatly appreciate if you could go to https://opentip.kaspersky.com/ and report the file as a false positive. More likely than not though, Kaspersky has taken DuckGame.exe by the collar and slammed it against the wall- taking control fo the file and stopping you from submitting the file to their detection analysis page. And so, a bit of work is necessary to submit the file, and to get back to playing Duck Game.

First, you need to create an exception for Duck Game in your antivirus software. If you're not comfortable with doing something like this, I understand and apologize for the situation. You'll likely have to wait either until the EXE has been permenantly cleared in Kaspersky's systems, or you can wait until I push another update at which point you'll likely have a few hours before Kaspersky's cloud system flags the file again.

I've only included instructions for Kaspersky here, if you're using Zone Alarm then check this page https://download.zonealarm.com/bin/inclient/ZA_HelpCenter/71685.htm

If you're comfortable with creating an exception for Duck Game in your antivirus, then continue on:

Adding an Exception for DG in Kaspersky Antivirus
================================================
First, right click the game in Steam and go Properties -> Local Files -> Browse Local Files. This will open up the folder with DuckGame.exe in it.

Now open Kaspersky and go Settings -> Threats and Exclusions.
Roll to the bottom and click 'Manage Exclusions'.

You could either add DuckGame.exe to the list, or, more than likely if Kaspersky has already deleted the file (or if it says "file in use") you might have to add the whole Duck Game folder to exclusions.

So, add either DuckGame.exe, or the Duck Game folder if the EXE is not available.
Scroll down and select 'All Components', then press Add at the bottom.

Now right click the game in Steam and go Properties -> Local Files -> Verify Integrity Of Game Files. This should restore DuckGame.exe and you should be able to play again.

Submitting Duck Game.exe for re-analysis
================================================
Finally, please go to https://opentip.kaspersky.com/
Upload Duck Game.exe to the page using Browse... and press "Analyze". Once it's done, there should be a button that says "Submit to reanalyze"- press it! In the description box, put something like

"This is a Steam game that Kaspersky says is a virus, but the developer insists that it's not!"


Thank you for your patience, and for your help!

[broadsword]

@superjoebob, sent the file to kaspersky to reanalyze with your commen
but found an easier way to keep kaspersky from deleting the file again before having the chance to upload it.
By the way your guide doesnt fit to my kaspersky product (internet security 2020)
My suggestion would be go to settings/protection/file-antivirus (first menu item on top) action on detection, choose automatic or if it´s still erased while trying to upload try "block".
My setting was "disinfect, erase if not possible", that´s why this happened. I translated the menu items from german to english, so the formulation may not match exactly .
Kaspersky now just block the exe, when trying to launch, but doesn´t delete it by default. Hope this helps those who don´t want to add an exception or just find this way a bit easier.

[HashtagVee]

Along with broadsword's comment, having managed to successfully follow the guide, I also recommend after managing exclusions and reinstalling the file to go back to the Threats and Exclusions, and then click "Specify trusted applications". That way you can go to the folder, select the executable and then save it as a trusted application. It wouldn't let me run the game until I did that.

[salomun]

.

[Angelinux]

:sempai:

[IvanAoyama12]

:O

[EffTea]

I can confirm that ZoneAlarm registers Duck Game as a virus as well, specifically claiming it to be Ransomware. The day I installed the Duck Game Mega Update 1.5, my Ransomware alert box popped up for the very first time in my entire time owning the program and said that I had files that were encrypted. Not only that, one of them was from Duck Game and a lot of others were in and out of Steam. (A little bit even went to my Keep Talking And Nobody Explodes install.)

While I agree that Duck Game is not itself a virus, I'm concerned that someone may have found a back door and slipped some fishy code in while you had your back turned. I've been running my computer with very solid security habits since I built it and have never had a true virus problem on my computer, so I'm not comfortable with playing until this situation is sorted out. I'm sure you can confer with ZoneAlarm to verify the legitimate status of your game, but maybe you should dig through the code and see if anyone's compromised it, just to be sure?

For the record, the one file in my Ransomware report that came from Duck Game was I think... trumpet1, forgot the extension. Hopefully that helps!

[broadsword]

no alerts when analyzing the whole duckgame folder with kaspersky internet security right now. (current game version)

[broadsword]

deleted again by kaspersky UDS:DangerousObject.Multi.Generic

[Ariona]

Thanks for the information, I am now reassured that it is just a mistake. I hope that will be cleared up for you as soon as possible.