Won't Download. Defender thinks this is a Wacatak.B!ml Trojan virus.

[ArtisanDejure]

Here are the details when the file is autodeleted as it is being downloaded. I've tried adding an exception for the URVR.zip file which doesn't seem to work.

\Downloads\UEVR.zip|https://objects.githubusercontent.com/github-production-release-asset-2e65be/531307134/ace918d1-d42a-4f21-b28c-c4b4a5fdb8c7?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAVCODYLSA53PQK4ZA%2F20240106%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240106T154456Z&X-Amz-Expires=300&X-Amz-Signature=cada4e6b52ee7139bbf44ae3330e23045c155be0cdbdb6c0c4992e9d5141eb2d&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=531307134&response-content-disposition=attachment%3B%20filename%3DUEVR.zip&response-content-type=application%2Foctet-stream|pid:3428,ProcessStart:133490294986615592

[JRDevo]

Similar with BitDefender "UEVR.zip tried to load a malicious resource detected as Gen:Variant.Midie.141938 and was blocked. Your device is safe."

Seems its also Kaspersky, check #17 (comment)

[Zeltrax]

Having same ish message aswell as chrome is blocking it.

We blocked this dangerous page for your protection:
https://objects.githubusercontent.com/github-production-release-asset-2e65be/531307134/ace918d1-d42a-4f21-b28c-c4b4a5fdb8c7?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAVCODYLSA53PQK4ZA%2F20240106%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240106T222201Z&X-Amz-Expires=300&X-Amz-Signature=84fd3ffbd2b238e01775b3071fedda569f8981553f82924a30cf7e28fa32b138&X-Amz-SignedHeaders=host&actor_id=8917813&key_id=0&repo_id=531307134&response-content-disposition=attachment%3B%20filename%3DUEVR.zip&response-content-type=application%2Foctet-stream
Threat name: Gen:Variant.Midie.141938
Dangerous pages attempt to install software that can harm the device, gather personal information or operate without your consent.

[xcrgames]

Same problem on my side of things.

[SaxoFr]

Idem avec l'antivirus Microsoft ... Que faire ?

[neovinter]

Same issue. Windows Defender sent file UEVRBackend.dll to quarantine.
Virustotal: 12 security vendors and no sandboxes flagged this file as malicious
What is the cause of this issue?

[JRDevo]

Downloaded & extracted 1.3 today without issues from Bitdefender.

Can others try?

[Zeltrax]

Downloaded & extracted 1.3 today without issues from Bitdefender.

Can others try?

Yep all working now for me.

[neovinter]

Downloaded & extracted 1.3 today without issues from Bitdefender.

Can others try?

I did, everything is much better now

[Gerion76]

I cant download it. Not working here.

[lucalemboure1]

same here :(
not working ==> Trojan.GenericKD.7129053

[xNepenthe]

Same over here.
Using Windows 11; blocked directly by Google Chrome, then when enabling "Insecure origins treated as secure", it downloads but gets flagged right away by Windows Defender: Trojan:Win32/Malagent!MSR

[mikashki]

Same experience as above. Tried to download just now, but the uevr.zip gets flagged and blocked by Windows Defender (Win11), also Chrome and Edge browsers refuse to download/save it on disc. Defender says it contains Trojan:Win32/Malagent!MSR

[praydog]

Try the Nightly builds. These are picked up by some vendors but not as many as the main build (yet). It might change as more runtime analysis is performed on them.

[mikashki]

Try the Nightly builds. These are picked up by some vendors but not as many as the main build (yet). It might change as more runtime analysis is performed on them.

Unfortunately, also the nightly build uevr.zip gets flagged. Now the zip download succeeded, but unzipping it causes a Windows Defender warning about Trojan:Win32/Wacatac.H!ml in uevrinjector.exe and the .exe is removed from the unzipped folder.

[dep]

@JRDevo

Downloaded & extracted 1.3 today without issues from Bitdefender.

1.3 of UEVR? The latest is beta 1.03

[JRDevo]

I meant 1.03.

[hamamichhi]

I downloaded it to my Macbook Pro and unzip.
then transfer by USB flash memory to a Windows 11 PC.
now I can open UEVR.

[bbadger07]

Here are the details when the file is autodeleted as it is being downloaded. I've tried adding an exception for the URVR.zip file which doesn't seem to work.

\Downloads\UEVR.zip|https://objects.githubusercontent.com/github-production-release-asset-2e65be/531307134/ace918d1-d42a-4f21-b28c-c4b4a5fdb8c7?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAVCODYLSA53PQK4ZA%2F20240106%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240106T154456Z&X-Amz-Expires=300&X-Amz-Signature=cada4e6b52ee7139bbf44ae3330e23045c155be0cdbdb6c0c4992e9d5141eb2d&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=531307134&response-content-disposition=attachment%3B%20filename%3DUEVR.zip&response-content-type=application%2Foctet-stream|pid:3428,ProcessStart:133490294986615592

dont work

[heiblum]

I also experience the same download and unzipping problems with W11 fully updated PC

[hectorC]

Same problem for me with Windows 11. It gets blocked by Microsoft Defender.

[iandanforth]

Do we know that this is in fact a false alarm?

[mrbelowski]

so every vendor detects something different. Surprised there's room for any functionality at all in the mod, given how many trojans it's packaged with.

It's not hard to build from source if these false positives are unsettling

[sher1ff]

sus

[indiana11011100]

so every vendor detects something different. Surprised there's room for any functionality at all in the mod, given how many trojans it's packaged with.

It's not hard to build from source if these false positives are unsettling

Well again (virustotal), and no I dont wanna blame anyone I just have concerns and really appreciate the great work on this tool I mean it is extremly great to see things like this are possible!
This time the whole asset got about 10 MB smaller (~21 not ~30) and less detections. Of course UEVR probably can have some strange behaviour for AV scans I guess. It says itself inject to VR, however this is really done and maybe this is suspicious for AV tools.
Anyway, my concern is not about the possible detection by e.g. AI scans, but now it is because there are still detections and the quite big suspect difference in file size (Just an indication or less graphics ... sure). And forgive me, as I still have concerns I would not compile (not as simple as creating a github account) locally to bypass an AV scan.

Maybe it would be possible to get in contact with some of the AV companies to get a detailed test or better exclusion on their side. This would be just a few E-Mails, so not as hard as build the source...

[praydog]

It's smaller because it was an automated build not done by my PC like the last one. It will be this way going forward.

[sean81]

same here my microsoft edge blocks the download

[RootlessAgrarian]

Similar issues here. Brave browser tried to block the zip file. When I said "Keep Dangerous File" anyway, Windows Defender then claimed it contained a Trojan and deleted the downloaded file. This is really not very confidence building... I'm not turning all my antivirus off just to play Abzu in VR. can this be fixed?

[them4ko]

For 4 months now this application is reported to have a TROJAN onboard by various anti-virus programs. And the developer isnt doing anything to improve on that with new releases?

100% sus - very high probability of being an ACTUAL trojan in there and not just a false positive.

Who ever downloads this and turns off their anti virus - is a fool.

[praydog]

You are free to compile it yourself. I've tried multiple things at this point. The next things I can try are removing PDBs from releases (unfortunate) and spending ridiculous amounts of money on a code signing certificate, which I am not going to do.

[heiblum]

Why don't you petreon this? I would love to use this and even pay, but the trojan alert I keeping me away from now.

I don't know code good enough to help in any other way than with money.

[praydog]

The other issue with signing this is that some anti cheats might allow this to be injected. That would be bad with the user generated content that can be made with this. A lot of stuff might have to be removed from signed builds (plugin loading, the 6dof system aka UObjectHook), kind of like how ReShade does it.

[dmealo]

You are free to compile it yourself. I've tried multiple things at this point. The next things I can try are removing PDBs from releases (unfortunate) and spending ridiculous amounts of money on a code signing certificate, which I am not going to do.

How about Sigstore for free (it looks like) open source signing?

[RootlessAgrarian]

Well from what I have read (and I don't understand this stuff) it looks like if you can just get the exe and dlls onto your Windows host (by some kind of end run like DLing on a Mac and transporting by sneakernet) you can then instruct the antivirus to make a specific exception for this folder only. I may try this just to see if it works. But I agree that just turning off active antivirus for DLs sounds suicidal given the amount of malware out there for WIndows. @praydog I feel your pain. certs are stupid expensive. I wonder though if the community would pony up for it to solve this problem. a gofundme? a patreon? you have a LOT of users and a lot of fans.

…

On Tue, Apr 9, 2024 at 8:30 AM them4ko ***@***.***> wrote: For 4 months now this application is reported to have a TROJAN onboard by various anti-virus programs. And the developer isnt doing anything to improve on that with new releases? 100% sus - very high probability of being an ACTUAL trojan in there and not just a false positive. Who ever downloads this and turns off their anti virus - is a fool. — Reply to this email directly, view it on GitHub <#79 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AECEIQY4XMJTHMCGHNUFAADY4QCRFAVCNFSM6AAAAABBPUM2VGVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDANBVGQ4DQMBSGY> . You are receiving this because you commented.Message ID: ***@***.***>

[kub04]

Bitdefender still detecting virus for me. Threat name: Gen:Variant.Lazy.492372.
Can't download at all.

[Liam-pixel378]

So, I use Windows Defender on Windows 11 as an antivirus, I first tried downloading it on Microsoft Edge, every time it would download, windows defender would give me a notification, different than chrome, every time it would detect it, i would click ok the notification, click the bad files, and say allow anyway, now, just apply the changes, I had to repeat this process a couple of times, but it worked out, just wanted to try to help while .net was installing :)

Edit: A virus injects its code into other programs, exactly what the UEVR injector does, so, it would not be wrong if an antivirus said it was a virus, as, technically, it is, just using its power when the user tells it to.

[y4my4my4m]

Same here, I don't see anything in the source code that seems suspicious... however, how do we know the compiled binaries offered for download is really what's in the source code?

[GoodMilkMan]

Virustotal report

[y4my4my4m]

@praydog can you explain what the issue is with the "signing"? I can't figure out what actually needs to be signed to not be recognized as a malicious application. Doesn't seem to make sense to me.

[ams-cs]

Probably, it's just the injector code that matches some pattern, but it's worth checking....

Has anybody else done a clean build to check if praydog somehow has a compromised PC? I suppose, in theory, some virus could be poisoning his builds. 🤷

[randomVRguy]

Real example: I suggested UEVR to people on YT to experience a new high quality Titanic 3D model ("Demo401") in VR. Example of a reply (and this happend several times):
"[...] Been reading about that. Windows and all browsers classify UEVR as a virus so I was taking my time to evaluate it. Not keen about designating a directory on my PC where all viruses can easily install."

Honestly, I'm thinking about stopping recommending it to people because at some point they'll think I want to spread malware or something.

@praydog I think this really holds back the use of the mod. But we don't realize that because we live in our bubble. Is there nothing you can do about it?

[y4my4my4m]

Probably, it's just the injector code that matches some pattern, but it's worth checking....

Has anybody else done a clean build to check if praydog somehow has a compromised PC? I suppose, in theory, some virus could be poisoning his builds. 🤷

i have not been able to successfully build and install, perhaps i'm doing something wrong, but i have installed all the requirements and followed the guide to the letter... I've done the UE registration, etc.

Anyone else had success in building it?

[aurism]

I successfully built v1.04 using the included compiling instructions and a fresh copy of Visual Studio 2022 Community Edition (installed with the "Desktop development with C++" and "Game development with C++" workloads). I then analyzed the resulting UEVRBackend.dll in VirusTotal. The result shows 2 vendors flagged it as malicious. This file is 5.09 MB in size according to VirusTotal.

In contrast, analyzing the precompiled UEVRBackend.dll file included in the 1.04 release zip file gives this result - 41 vendors flagged it as malicious. This file is 5.12 MB in size according to VirusTotal.

I am not a software expert, but this difference is a bit concerning to me. Please let me know if I complied it incorrectly or misinterpreted the result in any way.

[randomVRguy]

Interesting information. Praydog should really say something about this. Perhaps software components on his machine are indeed compromised/infected or something like that...

[praydog]

1.04 wasn't even compiled on my PC - it was compiled on GitHub's servers, so not sure what you want me to say. Nothing will change. You'll get the same result after thousands of people start using the DLL you compiled due to behavioral analysis.

The nightly builds exhibit the same behavior, small amounts of vendors flag anything. That changes once more and more people start using it. As of 1.04 I only upload the nightly builds onto the stable releases which are not even compiled on my PC.

[randomVRguy]

OK, thanks for the clarification. But it's weird how the versions differ depending on the PC they were compiled on.
Apart from that, it's for sure that this behavior holds back so many people from using it.

"That changes once more and more people start using it. "
Not sure if that has an impact, as of today, it's still a pain in the ass. If you're using Chrome, the download is still flagged as super high-risky and a normal user doesn't even get the file on the PC. You have to google for a work around. And even if you managed to keep the file on your PC, Windows will go crazy if you dare to extract the .zip. Only some enthusiastic people will come to the point of using it. According to my experience maybe 2 out of 10 who are interested end up using UEVR.

[praydog]

You've misread what I said. The detections go up once people actually start using it, not in an isolated environment on a developer's computer. It's also not weird at all for differences, there's different compiler versions and configurations, Debug, Release, RelWithDebInfo, etc...

I'm locking this conversation as nothing useful is coming out of this.