Found a virus in Schedule I files

[Rudra_Jr]

My Antivirus software Kaspersky detected a virus in Schedule 1 files

File - version.dll - HEUR:Trojan.Win64.DllHijack.gen
Location - C:\Program Files (86)\Steam\steamapps\common\Schedule I\

[Havok]

Początkowo opublikowane przez Aera:

Had the same issue and it does not come from mods itself but from the MelonLoader and seems to be a false positive when checking a VirusTotal. The file it flagged for you comes from installing the MelonLoader.

Can you share the virustotal link please?

[Nik]

Kaspersky bro oh my god

[Rudra_Jr]

Początkowo opublikowane przez Aera:

Had the same issue and it does not come from mods itself but from the MelonLoader and seems to be a false positive when checking a VirusTotal. The file it flagged for you comes from installing the MelonLoader.

I just checked and your are right, thanks for your comment, I will run a deep system scan and do a cleanup just in case

[76561199732857278]

Początkowo opublikowane przez Havok:

Początkowo opublikowane przez Aera:

Had the same issue and it does not come from mods itself but from the MelonLoader and seems to be a false positive when checking a VirusTotal. The file it flagged for you comes from installing the MelonLoader.

Can you share the virustotal link please?

{LINK USUNIĘTY}https://www.virustotal.com/gui/file/c1192fa07e19a7a6d831c30cc50dfd58907638c6ab04efd4c627dd1739b79ddc

[Rudra_Jr]

Początkowo opublikowane przez Nik:

Kaspersky bro oh my god

so which antivirus is the best in your opinion

[Havok]

Początkowo opublikowane przez Aera:

Początkowo opublikowane przez Havok:

Can you share the virustotal link please?

https://www.virustotal.com/gui/file/c1192fa07e19a7a6d831c30cc50dfd58907638c6ab04efd4c627dd1739b79ddc

link got removed, but I got it, thanks. And this isn't the file in question, the dll is version.dll

If someone could upload that, that would be fantastic. thanks

[76561199732857278]

Początkowo opublikowane przez Havok:

Początkowo opublikowane przez Aera:

{LINK USUNIĘTY}https://www.virustotal.com/gui/file/c1192fa07e19a7a6d831c30cc50dfd58907638c6ab04efd4c627dd1739b79ddc

link got removed, but I got it, thanks. And this isn't the file in question, the dll is version.dll

if you upload the file it literally shows this it's the same thing

[Rudra_Jr]

Początkowo opublikowane przez OPX Sanji:

Początkowo opublikowane przez Rudra_Jr:

My Antivirus software Kaspersky detected a virus in Schedule 1 files

File - version.dll - HEUR:Trojan.Win64.DllHijack.gen
Location - C:\Program Files (86)\Steam\steamapps\common\Schedule I\

NO YOU DIDN'T, this file is non-existent, it had to have come from or was generated by a mod, get a life and stop posting BS you clearly know nothing about and stop modding games until you know how to safely do so lol.

Nobody asked for your opinion, I paid for this game I can do whatever I want with it. If you can't be helpful try not being annoying. Get a life and learn to mind your own business

[★ ace ★]

none, no one antivirus can protect you from emerging threats, they can look for file signatures and known threats but are unless for emerging threats or zero day exploits

[Shaken_Widow]

Początkowo opublikowane przez ★ ace ★:

none, no one antivirus can protect you from emerging threats, they can look for file signatures and known threats but are unless for emerging threats or zero day exploits

best AV is not downloading things you are unsure of and researching those that you want to be sure of.

[Havok]

Początkowo opublikowane przez Aera:

Początkowo opublikowane przez Havok:

link got removed, but I got it, thanks. And this isn't the file in question, the dll is version.dll

if you upload the file it literally shows this it's the same thing

Oh, weird. Aight. Well, looks like VT says its clean, so this is a kaspersky FP then. Kaspersky is probably getting the heuristics for this rule

Even Kaspersky's sandbox doesn't detect it lmao. so... no idea whats going on here.

Matches rule Potential System DLL Sideloading From Non System Locations by Nasreddine Bencherchali (Nextron Systems) at Sigma Integrated Rule Set (GitHub)
Detects DLL sideloading of DLLs usually located in system locations (System32, SysWOW64, etc.).

[★ ace ★]

Początkowo opublikowane przez Shaken_Widow:

Początkowo opublikowane przez ★ ace ★:

none, no one antivirus can protect you from emerging threats, they can look for file signatures and known threats but are unless for emerging threats or zero day exploits

best AV is not downloading things you are unsure of and researching those that you want to be sure of.

pretty much, if you didn't write the code, don't trust it

[★ ace ★]

why it says hijack, probably a DLL injection

[Rudra_Jr]

Początkowo opublikowane przez Havok:

Początkowo opublikowane przez Aera:

if you upload the file it literally shows this it's the same thing

Oh, weird. Aight. Well, looks like VT says its clean, so this is a kaspersky FP then. Kaspersky is probably getting the heuristics for this rule

Even Kaspersky's sandbox doesn't detect it lmao. so... no idea whats going on here.

Matches rule Potential System DLL Sideloading From Non System Locations by Nasreddine Bencherchali (Nextron Systems) at Sigma Integrated Rule Set (GitHub)
Detects DLL sideloading of DLLs usually located in system locations (System32, SysWOW64, etc.).

Other people using Melonloader have reported the same, It does looks like a false positive, thanks for your help

[Goldark]

Those mod ofent dont even have virus, they are false positive