How to solve problem with Kaspersky AV detecting Launcher.exe as trojan horse

[Adriaman]

1) Wait for IOI to solve the problem.

2) Trust IOI and whitelist the file in your anti-virus.

3) Download the previous Launcher.exe from https://steamdb.info/depot/863552/history/?changeid=M:7099553322875185033 using DepotDownloader.

[Adriaman]

Please comment if this worked for you.

[Kunovega]

Or just white list the launcher like most sane people do when their antivirus has a false positive on a new file

[Adriaman]

Kunovega lähetti viestin:

Or just white list the launcher like most sane people do when their antivirus has a false positive on a new file

Yep, added this to the post. This assumes you trust the update though.

[Mr. Lambert]

How just deleting Kaspersky. It does absolutely nothing useful for anybody running Windows and therefore already using the built in Windows software.

[Azza ☠]

Mr. Lambert lähetti viestin:

How just deleting Kaspersky. It does absolutely nothing useful for anybody running Windows and therefore already using the built in Windows software.

It's one of the best security softwares around, which even detected the NSA (US Government spying) trojan virus injected into hard drive firmware and questioned it as it was hidden under another hackers groups name (Equation Group) which linked over to the NSA... which lead the USA to illegally raid Kaspersky's employees, shift focus and blame, claiming they rigged the US election and also attempted to blame the Russians for stealing NSA secrets and brenching their security.

Amazing stuff and well respected company! :D

The Kaspersky employees invited the raid in to their own homes and showed US the source code, server calls, etc. They have a triple opt-in just to get on the cloud network, in which the servers remain in the same country as the user.

Kaspersky isn't just an anti-virus software, but application control + firewall. It can even unlock ransomware screens and warn you of phishing websites, etc.

It's even helped the US deal with some of their major virus issues in the past. Even though the US government now boycotts it, because their CIA (Vault 7) and NSA hacking tools and malware leaked out to the public which any hacker could use and abuse, yet they didn't want their own exploits to be announced or blocked.

Compare this to Windows 10, which automatically opts-in to spying and you have to dig into 12 pages of privacy settings, plus use a third party application such as Shutup10 or SpyBot Anti-Beacon just to prevent it.

https://en.wikipedia.org/wiki/Equation_Group

https://arstechnica.com/information-technology/2017/11/kaspersky-yes-we-obtained-nsa-secrets-no-we-didnt-help-steal-them/

---

Anyways, Kaspersky just needs to file uploaded to them to confirm and white-list. It's clearly working the way it should be and warning the user correctly, due to the way the crash log information is collected and sent over online. You would want security software to do that. It's a bit too late if it didn't and just allowed any personal information to be gathered and thrown across the internet. Without a warning, you wouldn't of even known if it was grabbing your passwords, bank statements, social security and credit cards. Security software does have it's reasons and purposes.

[Hardware]

The link provided in OP's post is flagged as dangerous by both Chrome and Firefox. Download an exe from an unknown source is even worse.

Here are the solutions :

1. Wait for a fix from Kaspersky or IOI

2. Whitelist HITMAN 2 folder because you trust IOI and Steam packaging integrity system pipeline

How to be sure if it is infected, or if it is a false positive ? Contact Kaspersky Tech Support via https://my.kaspersky.com/support/ or https://community.kaspersky.com/ and their team will analyze the file quickly.

[Hannibal]

Zone Alarm also flagging hitman 2 .exe as a virus

[Adriaman]

Hardware lähetti viestin:

The link provided in OP's post is flagged as dangerous by both Chrome and Firefox. Download an exe from an unknown source is even worse.

That's quite odd, I don't get any alerts. I'll put it in a .zip to see if it helps.

I agree that it is in general not safe to download exes. In any case, this might be useful to someone, so here it is. Do note that you can download the file yourself using DepotDownloader.

[Kunovega]

Adriaman lähetti viestin:

Hardware lähetti viestin:

The link provided in OP's post is flagged as dangerous by both Chrome and Firefox. Download an exe from an unknown source is even worse.

That's quite odd, I don't get any alerts. I'll put it in a .zip to see if it helps.

I agree that it is in general not safe to download exes. In any case, this might be useful to someone, so here it is. Do note that you can download the file yourself using DepotDownloader.

Let's follow the logic here:

1. file is released from a reputable source (ioi) through a trusted distribution point (Steam) and causes some (but not all) anti-virus to have a false positive

The solution suggested is to...

2. Download a file from a random person on the internet from a non trusted distribution point and use that instead

See the problem? For anyone too paranoid to trust a steam distribution from a well known developer, it's highly unlikely they would trust a random source for a replacement file from some random place on the internet.

The difference is that at least getting the file from steam/ioi it's likely a false positive, not an actual virus. However, when your anti-virus gives an alert from some random file like you are promoting... hrm... that's kinda the types of sources you expect your anti-virus to protect you from.

[Adriaman]

Kunovega, I get your point, unfortunately I can't share the file directly without breaking the chain of trust. Well, I give up.

[>_rmb]

Kunovega lähetti viestin:

Adriaman lähetti viestin:

That's quite odd, I don't get any alerts. I'll put it in a .zip to see if it helps.

I agree that it is in general not safe to download exes. In any case, this might be useful to someone, so here it is. Do note that you can download the file yourself using DepotDownloader.

Let's follow the logic here:

1. file is released from a reputable source (ioi) through a trusted distribution point (Steam) and causes some (but not all) anti-virus to have a false positive

The solution suggested is to...

2. Download a file from a random person on the internet from a non trusted distribution point and use that instead

See the problem? For anyone too paranoid to trust a steam distribution from a well known developer, it's highly unlikely they would trust a random source for a replacement file from some random place on the internet.

The difference is that at least getting the file from steam/ioi it's likely a false positive, not an actual virus. However, when your anti-virus gives an alert from some random file like you are promoting... hrm... that's kinda the types of sources you expect your anti-virus to protect you from.

I only say Street Fighter 5 rootkit debacle - Capcom was also a trusted company. So there goes your logic.

[BernardoOne]

5) For the love of god it's 2020 stop using Kaspersky i has false positives for every thing

[Azza ☠]

BernardoOne lähetti viestin:

5) For the love of god it's 2020 stop using Kaspersky i has false positives for every thing

Updated definitions has fixed it. They just needed to check the file firstly.

And for the love of god it's 2020, START using Kaspersky or MalwareByte or similar.

I guess you have no idea about the new virus types and exploits such as "Surge20" which can infect and hijack LoT (Lot of Things - devices connected to your wifi, such as smart tvs, smartphones, roombas, and the list goes on). Making it possible for hackers to spy upon or use for DDoS attacks, etc. Viruses don't damage these days, they tend to remain stealth. Unless it's one which is mining (hijacking your CPU and GPU processing power) and/or encrypting your all your personal files with a ransomware lock out (demanding payment for your files back), etc, you will probably not even notice an infection and your pc being hijacked.

Why do you think Win 10 forced in Windows Defender which has just basic detection to stop mass global spreading viruses. It's because before at least 60% of the entire world was completely blindsided to being infected, there was a major BotNet of zombie PCs (infected with remote access for the hacker to use as proxities and bounce attacks upon) used in hacker attacks even against the Microsoft servers, Governments, CIA, and FBI, etc. They couldn't stop till then, because people where just like durrr I don't have a virus, not checking or using any protection to be able to tell (as it wasn't damaging their own PC, but rather attacking others from it).

A product like Kaspersky will also warn you about phishing links, secure your banking and online payments, protect your webcam from being spied upon, prevent rogue drive-by downloads, unlock ransomware lockouts, allow full application control into knowing whats happening on your PC, firewall protection, and warn you about security exploits even in third party software needing to be updated, etc.

You aren't being more secure by just being blind towards it.

[george47mathew]

niuoduab lähetti viestin:

BernardoOne lähetti viestin:

5) For the love of god it's 2020 stop using Kaspersky i has false positives for every thing

Imagine only using and relying on Windows Defender. Better getting false positives than getting no alerts or protection whatsoever.

Keeps deleting the launcher...

[Azza ☠]

george47mathew lähetti viestin:

niuoduab lähetti viestin:

Imagine only using and relying on Windows Defender. Better getting false positives than getting no alerts or protection whatsoever.

Keeps deleting the launcher...

Click "ignore" or "block" on the file, then run the "update" of your anti-virus scanner. Recheck that file, it should be clean now.

If your anti-virus settings aren't "Prompt on detection" but rather automatically "delete, if not disinfected", then still do the update, but also perform this next step to get the file back:

Under your Steam Client > Right-click the game Hitman 2 > Properties > Local (tab) > Verify integrity of game files

Let it scan the game files and re-download the missing one.