Distraint game being detected as VIRUS Real Protect-EC!B13D2D68119D

[seiya15]

I was playing the game and suddenly my antivirus pop up with a Trojan Alert! Why!!!!!!???????????????!!!!!!!!?????

Adaptive Threat Protection blocked a fileless-based attack because its reputation (Known Malicious) is below the configured Clean threshold.

[Wurm65]

What anti-virus? My sophos doesn't have an issue with it. And random virus warningssometimes point to a larger issue that has nothing to do with the file mentioned.

[seiya15]

Originally posted by Wurm65:

What anti-virus? My sophos doesn't have a n issue with it. And random virus warning sometimes point to a larger issue that has nothing to do with the file mentioned.

Mcafee Endpoint Security

[Wurm65]

Seems like Mcafee has a known problem with false positives.

https://community.mcafee.com/t5/Malware/False-Positive-Real-Protect-EC-DEB4BEA88807/td-p/592174

Others having issues with another steam game...

https://steamcommunity.com/app/871720/discussions/0/1743343017624354092/#c1743343017630699624

[nigh_anxiety]

I just started having this problem as well, although my copy of Distraint is through GOG, and it gives a slightly different virus ID (Real Protect-EC!B13D2D68119D)

What's weird is it ran fine for 2+ hours on Monday and another hour this morning. Then I quit and restarted to go back to the last save to see a scene again, and that's when McAfee started flagging it.

Direct scan of the Distraint.exe does not find any issues. It only occurs while running. Marking the distraint.exe file to be Excluded from Real-Time Scanning allowed me to run it and complete the game.

[Shotgun]

Kaspersky is now also detecting this as Trojan-Banker.Win32.ClipBanker.gen.

Likely a false positive, but still kind of weird.

[Von Stroheim]

Kaspersky same detection as above from Shotgun, the event log showed 4 threats tied to Distraint one of which was the program .exe as a Malicious Object "Reason- Machine Learning". For context reasons, I get a single alert maybe once every 3-5 months.

[sergio]

TROJAN-BANKER
Home Classes Trojan-Banker
Publication Date 04/19/2016
Parent class TrojWare
Description
Trojan-Banker programs are designed to steal user account data relating to online banking systems, e-payment systems and plastic card systems. The data is then transmitted to the malicious user controlling the Trojan. Email, FTP, the web (including data in a request), or other methods may be used to transit the stolen data.

[Shotgun]

Looks like this is no longer happening as of the recent update. Devs, what was the issue?

[One death guy]

I just scanned my Pc using Spyhunter 5 and it shows that exe file is a Trojan.Keylogger.AG

WTF??

[Vile~Frequency]

Same here, Kaspersky popped out this message out of nowhere, didn't even play the game or use gog at the time:

Event: Malicious object detected
User type: Active user
Application name: CompatTelRunner.exe
Application path: C:\Windows\System32
Component: File Anti-Virus
Result description: Detected
Type: Trojan
Name: HEUR:Trojan.Win32.Chapak.gen
Precision: Heuristic Analysis
Threat level: High
Object type: File
Object name: distraintlegacy.exe
Object path: D:\GOG\GOG Galaxy\Games\DISTRAINT Deluxe Edition\legacy
Reason: Machine learning
Databases release date: Today, 09-Dec-21 00:37:00

[One death guy]

Originally posted by Vile~Frequency:

Same here, Kaspersky popped out this message out of nowhere, didn't even play the game or use gog at the time:

Event: Malicious object detected
User type: Active user
Application name: CompatTelRunner.exe
Application path: C:\Windows\System32
Component: File Anti-Virus
Result description: Detected
Type: Trojan
Name: HEUR:Trojan.Win32.Chapak.gen
Precision: Heuristic Analysis
Threat level: High
Object type: File
Object name: distraintlegacy.exe
Object path: D:\GOG\GOG Galaxy\Games\DISTRAINT Deluxe Edition\legacy
Reason: Machine learning
Databases release date: Today, 09-Dec-21 00:37:00

fffffuuuu it looks like someone was trying to spy using that file as entry

WTF dev???

[Richy]

Originally posted by Vile~Frequency:

Same here, Kaspersky popped out this message out of nowhere, didn't even play the game or use gog at the time:

Event: Malicious object detected
User type: Active user
Application name: CompatTelRunner.exe
Application path: C:\Windows\System32
Component: File Anti-Virus
Result description: Detected
Type: Trojan
Name: HEUR:Trojan.Win32.Chapak.gen
Precision: Heuristic Analysis
Threat level: High
Object type: File
Object name: distraintlegacy.exe
Object path: D:\GOG\GOG Galaxy\Games\DISTRAINT Deluxe Edition\legacy
Reason: Machine learning
Databases release date: Today, 09-Dec-21 00:37:00

Same. Just had this a few mins ago

[sergio]

my Kaspersky too

[Richy]

Well my AV seems to be okay with this now.. probably false alarm

[altdiv]

Why!!!!!!???????????????!!!!!!!!?????