Virus warning ModUpdater.exe ?

[Ginsonic]

First: Thankx NoEx for your great work !

I just updated the current FreeCamMod version from MEGA but when unpacking, Defender shows a virus warning (Trojan:Win32/Skeeyah.A!rfn). Is this a false alarm or is the file actually infected ?

 

[nudnick]

First: Thankx NoEx for your great work !

I just updated the current FreeCamMod version from MEGA but when unpacking, Defender shows a virus warning (Trojan:Win32/Skeeyah.A!rfn). Is this a false alarm or is the file actually infected ?

Unfortunately I am now seeing this same thing. When trying to launch the Mod, I get prompt that there is an update, but when I go to click OK to get the update, I get error that "The server is not responding. Either its under maintenance or dwon. Please try again later ..."

I have come to discover that Windows Defender (I'm on win10) is completely removing and quarantine the file "ModUpdater.exe". I actually went out and re-downloaded from Mega as well, unzipped the rar and watched the ModUpdater just disapper. Then went back and downloaded again and unzipped it and before it could remove the ModUpdater.exe I double clicked it and it came up stating that it can not run the executable because it is a virus. I then checked Windows Defender Quarantine tab and sure enough, its removing the file from my system.

Are me and Ginsonic the only ones experiencing this?



Ginsonic ... are you running Windows 10?

 

[rothbauerw]

I am getting this as well.

It has identified it as a Trojan:Win32/Skeeyah.A!rfn

 

[Heretic]

its the french trojan horse! cameras where just a means to an end! unless somethings went grossly wrong you can just ingore the warning, noex has been a fine contributor to the community so as trusted as any.

question what anti virius are you boys using? is it possibley
the same one?

edit - ah windows defender i misread...what little ive used of it is that its acrazy pos....imo ingoreit

 

[nudnick]

its the french trojan horse! cameras where just a means to an end! unless somethings went grossly wrong you can just ingore the warning, noex has been a fine contributor to the community so as trusted as any.

question what anti virius are you boys using? is it possibley
the same one?

edit - ah windows defender i misread...what little ive used of it is that its acrazy pos....imo ingoreit

I agree ... and can't thank NoEx enough for his contributions. Would love to hear "your" opinion on this NoEx. It's hard to ignore the Skeeyah.A!rfn file when you start reading up on it ... creepy

http://malwarefixes.com/threats/trojanwin32skeeyah-arfn/

 

[Ginsonic]

Ginsonic ... are you running Windows 10?

Yes, I am running Windows 10 x64 !

And I really will not exclude the file from virus scanning until it is confirmed, that this is a false alert...

 

[Heretic]

agreed boys [MENTION=5267]NoEx[/MENTION] can confirm but heyyyyy pinall used to have cigsburns and a few aidsneedles

 

[NoEx]

Obviously this is a false positive, it's been flagged by Windows Defender recently because the file has not changed for a long time and it's detected as a trojan horse since a few days.

Unfortunately I can't really do much against that, I got to find a way to modify its signature, I guess it's flagged as a malicious file because it's downloading and dropping an exe file.

 

[nudnick]

Good deal ... I'm going for it ... I'm going to restore the file. I'll report back the results later ....

 

[nudnick]

So I restored the file in Windows Defender and ran the updater and got this:

I'm just KIDDING !!!

Everything seems to be fine. I restored the file in Windows Defender and it now shows that the "Skeeyah.A!rfn" file was deleted, but the "allow" page is empty. Mod is updated and running fine ...

 

[Jeff Strong]

 

[NoEx]

OK, I've modified ModUpdater.exe file a bit to change its signature, Windows Defender shouldn't detect it anymore as a threat.

Re-download the mod from here: https://mega.nz/#!FkcG1TCZ!BJrvkAjMz_MssUqTBglML5sxDrCcNCjwjXd2kNcIZ1E, it contains the updated ModUpdater.exe file, just extract it and replace the old file, other files remain unchanged.

 

[nudnick]

OK, I've modified ModUpdater.exe file a bit to change its signature, Windows Defender shouldn't detect it anymore as a threat.

Excellent! Thanks NoEx!

 

[Ginsonic]

Thanks, works now !