After last update Launcher.exe is deleted by Kaspersky AV with reason UDS:Trojan.Win32.Fsysna

[artemyv]

Is something wrong with last update or it is just false posive by Kaspersky and it is safe to revert the deleted file?

[Tharon]

https://virusscan.jotti.org/it-IT/filescanjob/2f1cfv7vhk

Of course is safe, and neither a false positive. Maybe Kaspersky is acting strange OR that file went infected in your system.

[artemyv]

Well when sent to Virus total I see that MD5 match yours
https://www.virustotal.com/gui/file/10aee39ce5b783ab9ed5a8133158dba4ff56a0b154012fc26d8fbb14044c6963/details
But the results - it is detected by KAV
https://www.virustotal.com/gui/file/10aee39ce5b783ab9ed5a8133158dba4ff56a0b154012fc26d8fbb14044c6963/detection

[Errollitos]

Same here, after the update, Kaspersky detected it as a malware

[GowHawx]

Same here,deleted after update.

Edit:i added the entire folder to exclusion list and re-verified the files installed through steam which re-downloaded the deleted file,all working now.

[MG]

#metoo

[Azirus Gaming]

same situation here. Kaspersky delete Launcher.exe :(

[Errollitos]

Just looked a little bit further: Kaspersky detected and deleted launcher.exe and 2 registry keys after the last mini update. I am guessing it deleted everything the update brought :-D

[Hardware]

IOI added a crash reporter solution in the last update, and "Launcher.exe" is one of the files updated according to steamdb. It's probably that. You guys should report this false positive to Kaspersky support to whitelist the file maybe.

I’m sure IOI will look into this issue quickly.

[༡ཞཀཁ]

same here, wtf?
we should report to kasp? yeah sure, we paid for the game and that is enough, if they used some sketchy code they have to fix that mess on their own, how do we know the file is safe?

[Tharon]

Originally posted by a6jamp:

same here, wtf?
we should report to kasp? yeah sure, we paid for the game and that is enough, if they used some sketchy code they have to fix that mess on their own, how do we know the file is safe?

False positive happens all the time, isn't a IOI fault.

[Hardware]

Originally posted by a6jamp:

same here, wtf?
we should report to kasp? yeah sure, we paid for the game and that is enough, if they used some sketchy code they have to fix that mess on their own, how do we know the file is safe?

You can wait for a fix, if you don't trust Hitman devs.

Right now, only one major antivirus solution detecting it as a virus, so the most likely scenario is a false positive.

https://www.virustotal.com/gui/file/10aee39ce5b783ab9ed5a8133158dba4ff56a0b154012fc26d8fbb14044c6963/detection

[Kunovega]

Your antivirus is overzealous, heuristic analysis is a "guess" that something might be a virus. Any new item that it doesn't recognize can be tagged until it's existed long enough for it to be placed in a white list as safe.

You can wait for Kaspersky to be updated or you can whitelist the file manually.

What is heuristic analysis: https://en.wikipedia.org/wiki/Heuristic_analysis

Once you understand how easy it is to get false positives with heuristic analysis, you should never be surprised when an update to a program you are already using will occasionally trigger one. It's nothing to fear, you do some investigation, realize the file is fine and white list it yourself.

What is false positive: https://blog.malwarebytes.com/security-world/2017/09/explained-false-positives/#:~:text=The%20most%20common%20causes%20of,that%20is%20usually%20considered%20malicious

You know the source of the update: https://steamcommunity.com/app/863550/discussions/0/2444840102034209708/

The only reason to be worried is when something like that pops up and you can't find a reason for the new file. In this case, you know the source and purpose of the file, so it's safe and your antivirus just doesn't recognize it yet.

[༡ཞཀཁ]

it might be safe but personally i will not risk it, either devs or kasp should update soon so i will wait, until then, uninstall

edit:this is posted by another member on the update post

After I added first object UDS:Trojan.Win32.Fsysna in the exe to exclusions
D:\Program Files (x86)\Steam\steamapps\common\HITMAN2\Launcher.exe
Next trojan was detected: UDS:DangerousObject.Multi.Generic
After excluding it as well - Suspicious activity was detected: PDM:Trojan.Win32.Bazon.a

[Azza ☠]

Ditto.

Hitman 2 updated with a small 234.5KB patch, labelled as a "Trojan.Win32.Fsysna" under the "HITMAN2\Launcher.exe".

Why such a small update, if not a malicious injection? Don't trust it just yet. Updater could be hijacked or something, if not just a false positive.

[Hardware]

Originally posted by Azza ☠:

Why such a small update, if not a malicious injection? Don't trust it just yet. Updater could be hijacked or something, if not just a false positive.

They just added a crash reporter, like BugTrap http://bugtrap.net/

They are usually very small pieces of code because their only purpose is to send the crash reports to the devs.

If you don't trust both IOI update (explained in a pinned post) and steam packaging integrity system, wait for a fix.