search

Tenrys / csgo_richpresence

Discord Rich Presence support for Counter-Strike: Global Offensive!
GNU General Public License v3.0
15 stars 2 forks source link

Trojan warning #9

Open tooruu opened 5 years ago

tooruu commented 5 years ago

Why should I trust this software? capture

tizbobby commented 5 years ago

CAN CONFIRM: I have a PhD in Holistic Software Development and this software is HIGHLY MALICIOUS! It has deleted all my softwares and PERMANENTLY damaged my graphics card!!! Don't worry though, I have been on-call with this very helpful man from India who is offering to repair it and salvage all my data for the low low price of $300 an hour.

PS please stop using computers

Tenrys commented 5 years ago

Because it's open source? You can check the code yourself for any malicious behaviour.

If anything, this is probably because the script:

  1. scans open processes (checks if CSGO is open)
  2. communicates through named pipes (kind of tricky stuff)
  3. is awfully coded, this is my first Python script

I have been planning to make a better version of this in JavaScript / Electron as I am much more accustomed to it, and to archive this repository because it is full of issues, but I've been busy with a Discord Bot.

tooruu commented 5 years ago

Can't you just upload fake source code to GitHub? I'm sorry if I sound stupid, I just don't believe everything I see. Tell me how GitHub works.

Tenrys commented 5 years ago

Well, I can. But that's not what I did. You don't need the .exe anyway, I did it for convenience but I realize that's really not a good way to do this. I understand how it gets marked as malicious: Unsigned packed python exe that adds itself to startup.

tooruu commented 5 years ago

I didn't use the installer tho. Do both exe files add this to startup?

Tenrys commented 5 years ago

Installer does.

tooruu commented 5 years ago

Installer was the exe which did not catch attention of Windows Defender

uwx commented 5 years ago

The program is flagged by windefend's detection (Trojan.Win32.Agent.qwghzv on my Kaspersky Internet Security 18) because it sets itself to auto-start with Windows. This is the well-accepted way of doing it, and it can get flagged as malware, but it is not. You can instead run the program from the source code using Python, which will not cause it to raise alarms.

Tenrys commented 5 years ago

Well, whatever