Tron.exe infected with TR/Kazy.5432848 virus

[Thomago]

It seems kinda ironical, but accoding to Avira Antivir the game's executable is infected with a virus. Deleting the executable and relading it via Steam's "Verify integrity of game cache" function doesn't help; the virus reappears, suggesting that this is a problem not on my side.

Anyone having the same problem?

[schmatzler]

That is most likely a false alarm. Only 1 hit out of 51 on virustotal:

https://www.virustotal.com/de/file/ef7c83fee036b83b6b3739298b355469d6a9c26b7b08e22bfc8d5cf25299be80/analysis/1417738837/

The file seems to be compressed somehow, this can trigger false positives.

So unless something else is infecting it, you can just ignore that.

[Thomago]

Thanks for the info!

Well... I'll have to look into what to do to make Avira ignore it.

[BridgetFisher]

maybe it has the steam virus infecting users? Im not installing this until Disney posts a clean exe without viruses and e worms.

[Thomago]

False positives are not uncommen for antivirus programs, but well... some official reassurance would be nice.

[TerraDyte]

I tried installing Tron 2.0 on another drive and it kept coming up w/ an error "not enough disk space", even though I excluded the directory to scan in bitdefender.
So I installed it on the C drive and it seems to be ok now but still comes up w/ that variant virus - Gen:Variant.Kazy.187835:

https://www.virustotal.com/en/file/b4651acd52169645e12a7c45c03b4b9b1f3b3639ebf519ca13798d47c05f6b8c/analysis/

Still, 14/55 detections is still quite a bit. I know it's probably a false positive too but regarding some of the top antivirus programs still detect it as a virus...still unsure!

[schmatzler]

@TerraDyte:

Your file really looks bad. But the original TRON.exe has a SHA256 of ef7c83fee036b83b6b3739298b355469d6a9c26b7b08e22bfc8d5cf25299be80, as you can see in my post here. And that one only gets one hit.

Your SHA256 is different to mine, so something has altered the Tron.exe - the one delivered via Steam is most likely clean.

[TerraDyte]

So, you saying there could be a virus on my PC?
I've run tests on it already, even in safe-mode, nothing's come up!

[schmatzler]

Have you only installed TRON 2.0 via Steam or did you also install the update 1.042 and the Killer App Mod afterwards? They have different executables, that could explain it. I only tested the one directly from Steam.

[LDSO]

I'm not going to dismiss the possibility that TRON.exe somehow became infected, after you downloaded it from Steam. But I can also see a case where TRON.exe is perfectly fine, and your anti-virus is flagging it as a false positive.

The TRON.exe you download from Steam has Steam's CEG DRM applied to it. It encrypts the .exe and requires the Steam client to be running before it will load. I can imagine some anti-viruses considering this type of behavior to be suspicious, because many viruses and malware also use forms of encryption to obfuscate their true nature.

The TRON.exe you uploaded to VirusTotal has the exact same file size (5432848 bytes) as the one I downloaded from Steam. If it became infected, it should have a different file size. Having the exact same size, after being infected, is extremely unlikely. It should be larger.

Also, TRON.exe having a different hash for every person is due to the CEG DRM. Steam creates a slightly unique version of TRON.exe every time it's downloaded. Think of it as a unique serial number being assigned to each download of TRON 2.0 from Steam. That way, no matter what computer you're on, if you run that copy of TRON.exe is will know which Steam account it came from.

If you want to eliminate your anti-virus flagging TRON.exe as a threat, download and install the Unofficial Patch listed in schmatzler's guide. It will replace Steam's TRON.exe with its own, and you should no longer get these warnings.

http://steamcommunity.com/app/327740/discussions/0/613938693156272172/

[Tholbin]

I'm also using Avira Antivir and getting the virus warning during install.

[schmatzler]

Originally posted by redrain85:

Also, TRON.exe having a different hash for every person is due to the CEG DRM.

Wow. I did not know that it is directly generated by Steam. I learn something new every day. :)

[TerraDyte]

Originally posted by schmatzler:

Have you only installed TRON 2.0 via Steam or did you also install the update 1.042 and the Killer App Mod afterwards? They have different executables, that could explain it. I only tested the one directly from Steam.

No, just downloaded via steam, no mods or independent updates :P

[WC?]

Originally posted by Thomago:

It seems kinda ironical, but accoding to Avira Antivir the game's executable is infected with a virus. Deleting the executable and relading it via Steam's "Verify integrity of game cache" function doesn't help; the virus reappears, suggesting that this is a problem not on my side.

Anyone having the same problem?

"Ironical"... haha omg >_<

[TerraDyte]

Originally posted by redrain85:

I'm not going to dismiss the possibility that TRON.exe somehow became infected, after you downloaded it from Steam. But I can also see a case where TRON.exe is perfectly fine, and your anti-virus is flagging it as a false positive.

The TRON.exe you download from Steam has Steam's CEG DRM applied to it. It encrypts the .exe and requires the Steam client to be running before it will load. I can imagine some anti-viruses considering this type of behavior to be suspicious, because many viruses and malware also use forms of encryption to obfuscate their true nature.

The TRON.exe you uploaded to VirusTotal has the exact same file size (5432848 bytes) as the one I downloaded from Steam. If it became infected, it should have a different file size. Having the exact same size, after being infected, is extremely unlikely. It should be larger.

Also, TRON.exe having a different hash for every person is due to the CEG DRM. Steam creates a slightly unique version of TRON.exe every time it's downloaded. Think of it as a unique serial number being assigned to each download of TRON 2.0 from Steam. That way, no matter what computer you're on, if you run that copy of TRON.exe is will know which Steam account it came from.

If you want to eliminate your anti-virus flagging TRON.exe as a threat, download and install the Unofficial Patch listed in schmatzler's guide. It will replace Steam's TRON.exe with its own, and you should no longer get these warnings.

http://steamcommunity.com/app/327740/discussions/0/613938693156272172/

Wow, thanks for the reply. I did not know that about the CEG DRM. Cheers! :)

[PCGameGuy]

So I am expirimenting with this, told Avira to 'Ignore Forever' and now it is in an install loop. UAC asks about Steam per usual first run, then a second UAC about the Tron.exe pops up. Repeat ad infinitum. Watching closely it calls out to a registry.bat file which is most likely the source of the second UAC popup. Opened the .bat and it is a list of REG ADD for linking up Tron 2.0 stuff. Regedit shows it is not happenning though, no ontries in my registry at least. No solution, but more information at least.