Found a virus in Schedule I files

[Rudra_Jr]

My Antivirus software Kaspersky detected a virus in Schedule 1 files

File - version.dll - HEUR:Trojan.Win64.DllHijack.gen
Location - C:\Program Files (86)\Steam\steamapps\common\Schedule I\

[This PC]

Did you install mods ?

[Full Clog Destroyer]

Kaspersky is trash.

[★ ace ★]

what is detecting it? generate a md5 or a sha256 and check virus total

[Rudra_Jr]

This PC a écrit :

Did you install mods ?

I did a couple from Nexus but they're located in \mods folder and there was no file named version.dll in that folder

[niceGuy]

Full Clog Destroyer a écrit :

Kaspersky is trash.

everything is sus these days

[★ ace ★]

niceGuy a écrit :

Full Clog Destroyer a écrit :

Kaspersky is trash.

everything is sus these days

what do you expect from a russian company...

[Rudra_Jr]

Full Clog Destroyer a écrit :

Kaspersky is trash.

That's your opinion, not helpful in anyway

[a passerby]

no idea what that file is. probably from one of those malicious mods from nexus

[★ ace ★]

if the AV caught the file then it got quarantined, it won't be in that location anymore for most default settings

[Havok]

Funny, I don't have a version.dll in my game folder.

So that is not a game file, that is a mod file

I only have these files:
UnityPlayer.dll
UnityCrashHandler64.exe
Schedule I.exe
GameAssembly.dll
baselib.dll
Schedule 1_Data/

And there is no version.dll in Schedule 1_Data/ folder. Just verified my files, on the latest patch, and there is no file by that name. You downloaded a virus bub.

[Shaken_Widow]

Rudra_Jr a écrit :

Full Clog Destroyer a écrit :

Kaspersky is trash.

That's your opinion, not helpful in anyway

considering you downloaded and installed something that contained that virus, (likely a mod that injected it,) that opinion is valid

kaspersky is in fact trash, it didn't catch it until after it likely had already done damage, you likely now have to redo all of your passwords on everything because that virus was actually able to be installed to begin with because it was likely activated upon the installation of whatever put it there, again likely a mod.

[redes]

you downloaded a 'mod' that was actually a virus

[Rudra_Jr]

Shaken_Widow a écrit :

Rudra_Jr a écrit :

That's your opinion, not helpful in anyway

considering you downloaded and installed something that contained that virus, (likely a mod that injected it,) that opinion is valid

kaspersky is in fact trash, it didn't catch it until after it likely had already done damage, you likely now have to redo all of your passwords on everything because that virus was actually able to be installed to begin with because it was likely activated upon the installation of whatever put it there, again likely a mod.

I've been using Nexus for a long time, never even considered it. But you're right it must be a mod, thanks for the help

[Rudra_Jr]

redes a écrit :

you downloaded a 'mod' that was actually a virus

seems like it

[Banzai]

These mods are known to be infected:

🛑 Increased Stacklimit (contains malware!)
🛑 Backpack Mod – Reupload (also infected!)