Mod is being marked as a virus via BitDefender

Question

Mod is being marked as a virus via BitDefender

Treazul opened this issue a year ago · 9 comments

Treazul commented a year ago

Upon running a modpack with this mod bitdefender has marked it as infected
The file D:\ATLauncher\instances\TerraFirmaGreg\mods\Ksyxis-1.2.2.jar is infected with Trojan.GenericKD.72678267 and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean.

Treazul commented a year ago

k

VidTu · Answer 1 · 2024-05-23T21:06:57.000Z

BitDefender no longer flags 1.2.2 as infected, other vendors should follow shortly

VidTu · Answer 2 · 2024-05-20T14:29:31.000Z

hopefully fixed in 1.3.0.

VidTu · Answer 3 · 2024-05-10T08:54:56.000Z

@Treazul either your specific JAR is infected, your PC is infected with something else or you're getting man-in-the-middle-attacked: https://www.virustotal.com/gui/file/8e97bb392718099d54377738a3501284eef98fbd54f6b46b4350fc9267ef4d47

Treazul · Answer 4 · 2024-05-10T09:07:28.000Z

It's probably just a false positive. I've submitted the file to the av and let them know

…

On Fri, 10 May 2024 at 18:55, VidTu ***@***.***> wrote: @Treazul <https://github.com/Treazul> either your specific JAR is infected, your PC is infected with something else or you're getting man-in-the-middle-attacked: https://www.virustotal.com/gui/file/8e97bb392718099d54377738a3501284eef98fbd54f6b46b4350fc9267ef4d47 — Reply to this email directly, view it on GitHub <#25 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAIOXSRMRFAEBGLHFFEAEB3ZBSDPLAVCNFSM6AAAAABHOJHJPKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDCMBUGIZDAMJYGM> . You are receiving this because you were mentioned.Message ID: ***@***.***>

Treazul · Answer 5 · 2024-05-10T09:13:58.000Z

Correction, it is a false positive.

…

On Fri, 10 May 2024 at 19:07, Sam ***@***.***> wrote: It's probably just a false positive. I've submitted the file to the av and let them know On Fri, 10 May 2024 at 18:55, VidTu ***@***.***> wrote: > @Treazul <https://github.com/Treazul> either your specific JAR is > infected, your PC is infected with something else or you're getting > man-in-the-middle-attacked: > https://www.virustotal.com/gui/file/8e97bb392718099d54377738a3501284eef98fbd54f6b46b4350fc9267ef4d47 > > — > Reply to this email directly, view it on GitHub > <#25 (comment)>, or > unsubscribe > <https://github.com/notifications/unsubscribe-auth/AAIOXSRMRFAEBGLHFFEAEB3ZBSDPLAVCNFSM6AAAAABHOJHJPKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDCMBUGIZDAMJYGM> > . > You are receiving this because you were mentioned.Message ID: > ***@***.***> >

Treazul · Answer 6 · 2024-05-10T09:18:12.000Z

Scratch that. I clicked "Reanalyse" on virus total and it's reporting [image: image.png]

…

On Fri, 10 May 2024 at 19:13, Sam ***@***.***> wrote: Correction, it is a false positive. On Fri, 10 May 2024 at 19:07, Sam ***@***.***> wrote: > It's probably just a false positive. I've submitted the file to the av > and let them know > > On Fri, 10 May 2024 at 18:55, VidTu ***@***.***> wrote: > >> @Treazul <https://github.com/Treazul> either your specific JAR is >> infected, your PC is infected with something else or you're getting >> man-in-the-middle-attacked: >> https://www.virustotal.com/gui/file/8e97bb392718099d54377738a3501284eef98fbd54f6b46b4350fc9267ef4d47 >> >> — >> Reply to this email directly, view it on GitHub >> <#25 (comment)>, or >> unsubscribe >> <https://github.com/notifications/unsubscribe-auth/AAIOXSRMRFAEBGLHFFEAEB3ZBSDPLAVCNFSM6AAAAABHOJHJPKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDCMBUGIZDAMJYGM> >> . >> You are receiving this because you were mentioned.Message ID: >> ***@***.***> >> >

Dorrivix · Answer 7 · 2024-05-13T07:48:11.000Z

*got this on mod version 1.2.2, the file extension isn't .jar, it's .bNIhAX

the full file my av shows is Ksyxis-1,2,2,jar.bNIhAX

download method: modpack via prism launcher, downloading from modrinth.

trying to download the mod again seems to end with a random string as the file extension, not just ".bNlhAX"

my AV is called "Vipre".

Dorrivix · Answer 8 · 2024-05-13T14:12:49.000Z

it doesn't trigger with downloading version 1.2.1

Share to