Windows Defender detected a virus after installing VRChat

[DJ Spit]

Basically I've just installed VRChat and after 5 minutes of playing it I've got a notification from the Windows Defender that said it found a malicious program on my computer. "Zwangi Malware" that's what it's called. I wanna point out that I'm not the only one who's got the exact same virus right after installing this game. Here I'm linking this guy's post who's also experienced something like that. https://steamcommunity.com/app/438100/discussions/5/2595630410192955110/ I don't know what to think, cause it couldn't be just a coincidence that a few people got the exact same virus after installing the exact same game. I also wanna point out that I didn't download any "community assets" from that game that could potentially carry viruses, just the game files. The other thing is that when I closed the game a little window popped up asking me to grant some permission to "Make my experiences of sharing with friends better" or something like that. I don't know that seems kinda fishy. Tell me what you guys think, I also would like to get an explanation from the game authors.

[DJ Spit]

引用自 poesescape：

they should probably install filters of some kind that prevent malicious viruses/code from hopping players or running

im pretty sure ive had a couple times where something suddenty DDOS'd the game and i had to restart or leave to another world

I'm not talking about the cheaters or people who use some software to get things like speedhack or whatever. I'm talking about actual viruses that can spy on you without you even knowing(Steal your files from your computer, monitor your email install other malicious programs on your computer, etc.). I've just got one of those. And it's quite possible that I'm not the only one. So you better scan your computer.

[Novajone]

well i hope you are not useing some kinda client modded to cheat vr chat cuse that one dos contain malware not sure if it is possible they can added into map levels giveing doubt it would work.

[DJ Spit]

引用自 Novajone：

well i hope you are not useing some kinda client modded to cheat vr chat cuse that one dos contain malware not sure if it is possible they can added into map levels giveing doubt it would work.

As I've already said. I only downloaded and installed the official game client via Steam. Nothing more.

[Okami Amaterasu]

引用自 Dopit：

Wait you got a message saying to install something, after you exit the VRChat game client?

I did too, I said yes and nothing has happened after it...so far anyway.

[DJ Spit]

引用自 Okami Amaterasu：

引用自 Dopit：

Wait you got a message saying to install something, after you exit the VRChat game client?

I did too, I said yes and nothing has happened after it...so far anyway.

I recommend you Ctrl-Alt-Del > Task Manager then check through all the active programs, active processes and don't forget about the autoboot section if there's something unusual > Open file location of that program and delete. Scan your computer with your antivirus software as well.

[Okami Amaterasu]

引用自 AncWar：

引用自 Okami Amaterasu：

I did too, I said yes and nothing has happened after it...so far anyway.

I recommend you Ctrl-Alt-Del > Task Manager then check through all the active programs, active processes and don't forget about the autoboot section if there's something unusual > Open file location of that program and delete. Scan your computer with your antivirus software as well.

Nothing I see unusual in task manager, I should add this was a while ago, before the sudden reports of anti-virus's reporting the game as malware.

Though I am gonna run a virus scan just incase.

[Okami Amaterasu]

Ran it through windows defender and it didn't pick anything up, maybe it's a false positive from an update? I dunno. Have the devs commented on it yet?

[Okami Amaterasu]

引用自 Eyes of God：

1. Antivirus became useless when strong malware already inside your PC, even you have strongest Antivirus.
2. Hackers could change any things(exit, cancel, images, No,...) to Yes.
3. Task Manager wouldn't show deeper programs.
4. Legal programs are easy infected when they haven't anything to protect themselves. Even you didn't download from illegal website.
5. You better reinstall your windows and always update it.
6. Windows defender is worst antivirus ever.
I Recommend, Free: Avast, Avira. Pay: Bitdefender, Kaspersky, Norton
Note: Be careful to pick up right antivirus for PC, if it's heavy and slow down your PC, your PC are doomed and very hard to remove them.
7. After closed VRChat on desktop, a small pop-up "VRChat Installation Helper" will show up. It's just allow you to use an address to go to a world on VRC.

So I'm boned or no? Cause it's been a long time and nothing has happened so far.

[SugaryMess]

引用自 Okami Amaterasu：

引用自 Eyes of God：

1. Antivirus became useless when strong malware already inside your PC, even you have strongest Antivirus.
2. Hackers could change any things(exit, cancel, images, No,...) to Yes.
3. Task Manager wouldn't show deeper programs.
4. Legal programs are easy infected when they haven't anything to protect themselves. Even you didn't download from illegal website.
5. You better reinstall your windows and always update it.
6. Windows defender is worst antivirus ever.
I Recommend, Free: Avast, Avira. Pay: Bitdefender, Kaspersky, Norton
Note: Be careful to pick up right antivirus for PC, if it's heavy and slow down your PC, your PC are doomed and very hard to remove them.
7. After closed VRChat on desktop, a small pop-up "VRChat Installation Helper" will show up. It's just allow you to use an address to go to a world on VRC.

So I'm boned or no? Cause it's been a long time and nothing has happened so far.

You're pretty much fine. I've gotten the same VR Helper thing when I first played the game, and this was weeks before the whole hacker thing popped up. Nothing has happened or been detected since either.

[Okami Amaterasu]

引用自 SugaryMess：

引用自 Okami Amaterasu：

So I'm boned or no? Cause it's been a long time and nothing has happened so far.

You're pretty much fine. I've gotten the same VR Helper thing when I first played the game, and this was weeks before the whole hacker thing popped up. Nothing has happened or been detected since either.

So I guess there's a chance it's a false positive it seems...weird that it's popping up on some peoples WD but not others.

[Cyntonian]

引用自 Okami Amaterasu：

引用自 Eyes of God：

1. Antivirus became useless when strong malware already inside your PC, even you have strongest Antivirus.
2. Hackers could change any things(exit, cancel, images, No,...) to Yes.
3. Task Manager wouldn't show deeper programs.
4. Legal programs are easy infected when they haven't anything to protect themselves. Even you didn't download from illegal website.
5. You better reinstall your windows and always update it.
6. Windows defender is worst antivirus ever.
I Recommend, Free: Avast, Avira. Pay: Bitdefender, Kaspersky, Norton
Note: Be careful to pick up right antivirus for PC, if it's heavy and slow down your PC, your PC are doomed and very hard to remove them.
7. After closed VRChat on desktop, a small pop-up "VRChat Installation Helper" will show up. It's just allow you to use an address to go to a world on VRC.

So I'm boned or no? Cause it's been a long time and nothing has happened so far.

Zwangi malware is 7 years old by now. It would redirect anything you type in your browser to their crappy site (pretty sure you would notice that), and take screenshots in the background (spyware style).
This is most likely a false positive from Windows Defender, I would recommend you to get a proper antivirus.
Also the "VRChat installation helper" allows you to join worlds by opening the link in your browser, it basically a plugin, not a fancy installer for malware.
Aside from that, Steam scans any software uploaded to their servers, do you think they would allow to get malware up on their systems and spread it to other clients? If an developer would upload malicious content he would most likely face harsh consequences.

[Okami Amaterasu]

引用自 ๖ۣۜPollux：

引用自 Okami Amaterasu：

So I'm boned or no? Cause it's been a long time and nothing has happened so far.

Zwangi malware is 7 years old by now. It would redirect anything you type in your browser to their crappy site (pretty sure you would notice that), and take screenshots in the background (spyware style).
This is most likely a false positive from Windows Defender, I would recommend you to get a proper antivirus.
Also the "VRChat installation helper" allows you to join worlds by opening the link in your browser, it basically a plugin, not a fancy installer for malware.
Aside from that, Steam scans any software uploaded to their servers, do you think they would allow to get malware up on their systems and spread it to other clients? If an developer would upload malicious content he would most likely face harsh consequences.

Ahh I see. I've never actually heard of Zwangi.

[Novajone]

http://steamcommunity.com/app/438100/discussions/0/1693785035811143531/

[DJ Spit]

引用自 Eyes of God：

1. Antivirus became useless when strong malware already inside your PC, even you have strongest Antivirus.
2. Hackers could change any things(exit, cancel, images, No,...) to Yes.
3. Task Manager wouldn't show deeper programs.
4. Legal programs are easy infected when they haven't anything to protect themselves. Even you didn't download from illegal website.
5. You better reinstall your windows and always update it.
6. Windows defender is worst antivirus ever.
I Recommend, Free: Avast, Avira. Pay: Bitdefender, Kaspersky, Norton
Note: Be careful to pick up right antivirus for PC, if it's heavy and slow down your PC, your PC are doomed and very hard to remove them.
7. After closed VRChat on desktop, a small pop-up "VRChat Installation Helper" will show up. It's just allow you to use an address to go to a world on VRC.

Zwangi malware is pretty much nothing, I've already deleted everything, but the fact that I somehow managed to get it by installing the official client from Steam is still bugging me...

[zuzu]

Probably detected Ugandan Knuckles lol