Norton Identifies - Trojan.Gen.SMH as being imbedded in Samorost3.Exe

[Tyger Eyes]

I have not had a chance to play this game as I have been play other games I just purchased; however, I have just had Norton indicate the 'samorost3.exe' file contains the trojan Trojan.Gen.SMH. I purchased this game because the suite of games was on sale I played the "Machinarium" game on the iPhone (which I really enjoyed) and thought it would be great to see what other creative ventures these developers have been up to.

Obviously, I am uninstalling this game and other games by the same company that I purchased in a group sale and have requested a refund. If you are the developors and wish to know the details, please contact Steam as I have uploaded a screen capture of Norton pop-up.

Remember, I have iPhone version of Machinarium and really enjoyed the game so it is nothing personal and I was really looking forward to playing them... I just cannot risk potential infection.

Best Wishes... TE

[Frack]

I just bought this game and got the same warning. The game won't install unless I allow "Trojan.Gen.SMH" to access my computer, and I'm not gonna do that of course. Going to return for a refund until this is explained or fixed.

[Simon]

There's probably a simple explanation for this. The game has been out for some time and there haven't been any similar reports as far as I'm aware. According to this link, "Trojan.Gen.SMH is a generic detection for many individual but varied Trojans for which specific definitions have not been created": http://securityresponse.symantec.com/security_response/writeup.jsp?docid=2013-041522-2144-99&tabid=2

This leads me to believe that it's probably a false positive. Fortunately, I'm not on the list of affected systems (Windows 10) but I believe Windows Defender is very capable of detecting such threats now and I haven't had any reports or noticed anything untoward.

Perhaps your systems have already been comprimised or that it's just Norton's way of trying to scare the user into ongoing subscriptions.

[Getty]

scanned with eset and no warnings. must be a false positive

[variantemplar]

To be authentic, these are some rather misguided bits of advice. I can offer this: https://virusscan.jotti.org/

Best Anti-malware packages to rub this up against are Bitdefender and Kaspersky. This site above will run scans against a given file that you upload and tell you the results. None of the other packages found issues so I'd agree it's a False positive, but I'd never trust Windows Defender ot eset alone as my benchmarks. Eset tends to suffer from being a month behind their competitors.

To see how the various packages line up, look to AV Comparitives here: http://www.av-comparatives.org/dynamic-tests/

[Simon]

Cool links, thanks!

Let's just say that since Windows 8 (and especially Windows 10), Windows Defender is a hell of a lot better than the bad old days when having antivirus software was absolutely critical...so much so that Windows nagged you about installing it. But now not so much. According to those reports it performs almost to the level of many dedicated third party virus scanners and in some months better than some. Yes, for absolute best protection one of those packages you mentioned is advised, but let's face it, risk is also down to the particular activities and behaviours of the user also.

I'm comfortable not having third-party antivirus software in Windows now, and this is coming from a Mac user. But that doesn't constitute advice anyone else shouldn't. I know my behaviours put me at far lower risk than average. If you're not sure whether yours do, you should probably assume that they don't.

[variantemplar]

Originally posted by Simon:

Cool links, thanks!

Let's just say that since Windows 8 (and especially Windows 10), Windows Defender is a hell of a lot better than the bad old days when having antivirus software was absolutely critical...so much so that Windows nagged you about installing it. .

As a Security Professional who deploys this particular OS to DoD and Federal Agency Customers, I can tell you don't bother trusting Windows Defender. We are regularly directed to disable it.

But it's worth adding EMET on top of a decent Anti-malware package.

[oldes.huhuman]

Hello, it is false positive, which you can prove by submitting the file here: https://submit.symantec.com/false_positive/.

The reason is, that I was injecting hires icon into exe file, which than Norton seems to detect as generic trojan. With just published update is the exe without this modification, so it should not be confusing your Norton anymore.

Sorry for this trouble.

[Tyger Eyes]

Great! Thank-You. I posted not to create problems but so the developers would take note and deal with the issue one way or the other. Thank-you, for your attention to this matter,

`Tyger~

Originally posted by oldes.huhuman:

Hello, it is false positive, which you can prove by submitting the file here: https://submit.symantec.com/false_positive/.

The reason is, that I was injecting hires icon into exe file, which than Norton seems to detect as generic trojan. With just published update is the exe without this modification, so it should not be confusing your Norton anymore.

Sorry for this trouble.

[Frack]

Originally posted by oldes.huhuman:

Hello, it is false positive, which you can prove by submitting the file here: https://submit.symantec.com/false_positive/.

The reason is, that I was injecting hires icon into exe file, which than Norton seems to detect as generic trojan. With just published update is the exe without this modification, so it should not be confusing your Norton anymore.

Sorry for this trouble.

Thanks so much! :D I figured it was something harmless but wanted to make sure. And thanks to the commenters for the advice on false positives... I'll watch out for those in the future, Norton is dumb sometimes. >.<

[Simon]

Yeah if anything you found some other providers that are better than Norton with lower false positive rates.

Hope you bought the game again! It's delightful.

[variantemplar]

Originally posted by Simon:

Yeah if anything you found some other providers that are better than Norton with lower false positive rates.

Again - not necessarily true... Just a "martian event" in this case. ;)

[Simon]

Riiiight.

Well feel free to stick with Norton at your own risk:

http://www.extremetech.com/internet/230977-google-finds-norton-symantec-security-software-riddled-with-critical-vulnerabilities

Suddenly my earlier post sounds a whole lot more justified. Not that I intended it as advice for anyone but if I was going to use a third party virus scanner it sure as hell wouldn't be Norton.

[variantemplar]

And they fixed it. We've found similar issues in other implementations, as well as lacking in Secure Software Lifecycle (S-SDLC) development practices.

Industry is riddiled with these sorts of issues - push to reduce cycle time an increase profit margins decreases Security adherance. Expect things to get worse with DevOps Cloud apps.

[Femapisa]

Originally posted by Tyger Eyes:

I have not had a chance to play this game...

Hi!
I have Norton 360 Premium which notifies me that HEUSINKVELD software for my simulation pedals comes with Trojan.Gen.9.
So I didn't install anything for the pedals losing some features that this software provides.
I contacted HEUSINKVELD and they told me that this was not a virus and that it was a (false positive!?) from Norton.
I also know that there are a lot of Norton users who have the same problem but with other applications such as Battle Eye among others.
I would be grateful if someone could provide me some information about this problem that Norton causes for several users.
Thank you

[bur]

One advice: get rid of Norton. A dedicated antivirus is not necessary anymore and often causes more problems than it solves. Windows 10 and 11 have very good integrated anti virus software that is usually ranked #1 or #2 in tests. Dedicated antivirus software is a thing of the past, but of course the AV companies still try and scare you into buying their overpriced products.