search

stfwi / engineers-decor

Engineer's Decor
MIT License
35 stars 16 forks source link

1.18.2-1.1.22 version flags as containing Trogan #211

Closed AYM3159 closed 2 years ago

AYM3159 commented 2 years ago

Windows defender immediately flags the mod as Trogan.

Detected: Trojan:Script/Wacatac.B!ml file: C:\Users\ ....\ mods\engineersdecor-1.18.2-1.1.22.jar

All previous versions do not flag in this way. Please remedy.

stfwi commented 2 years ago

Hi, oh that's a critical thing, good that your system saw that and blocked. I quickly double checked my upload on Curse, and according to my system and also virustotal.com, it's clean.

My advice, although I am no IT expert, would be

full-scan

MaxWasUnavailable commented 2 years ago

I can actually confirm that I've had the same happen with this mod, as well as the following mods;

Is there anything that these 3 mods all use / implement that might be triggering Windows?

stfwi commented 2 years ago

Not sure, I presume it could have to do with heuristics. The change between 1.1.22b2 and 1.1.22 was only a change in the Dropper (issue #209). For the port 1.18.1 to 1.18.2 I've rewritten the registry handling.

Did you have the 1.1.22b2 mod version installed before without trouble, or did you upgrade from 1.18.1?

MaxWasUnavailable commented 2 years ago

Not sure, I presume it could have to do with heuristics. The change between 1.1.22b2 and 1.1.22 was only a change in the Dropper (issue #209). For the port 1.18.1 to 1.18.2 I've rewritten the registry handling.

Did you have the 1.1.22b2 mod version installed before without trouble, or did you upgrade from 1.18.1?

It seems to have resolved itself. I assume they flagged it as a false positive on their side. All mods that previously came up as trojans are now clean.

To answer your question though, I made the modpack fresh for 1.18.2; So it's likely b2 that triggered it?

stfwi commented 2 years ago

Hey Max, ty for the feedback, I was already spinning my head around what this could be - virus detection is a critical thing, it can lead to mistrust in modding in general. So, really glad it's gone in your setup. @NMPopsicle Do you still have it? Cheers,-

AYM3159 commented 2 years ago

Hey Max, ty for the feedback, I was already spinning my head around what this could be - virus detection is a critical thing, it can lead to mistrust in modding in general. So, really glad it's gone in your setup. @NMPopsicle Do you still have it? Cheers,-

Hi~ Downloaded from CursedForge just now. It no longer flags in the same manner. I had placed a band-aid on the issue previously by ignoring the mod folder in my virus detection. Removed that folder exception and it's not flagging either. So it appears whatever issue cause the false flag has thankfully resolved itself.

stfwi commented 2 years ago

Very cool, ty for the feedback.