BitDefender detected a Trojan :: Estranged: Act I 綜合討論

Estranged: Act I

Estranged: Act I > 綜合討論 > 主題細節

Tomboeg 2020 年 7 月 8 日上午 11:57

BitDefender detected a Trojan

Hello.

I believe i've just encountered a false positive in the latest Estranged Act I update.

`The file T:\Steampowered\steamapps\common\Estranged Act I\estrangedact1\html\mail\mail1.html is infected with JS:Trojan.Cryxos.3771 and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean.`

Just a heads up, have a good weekend in advance.

此應用程式的開發人員已將一篇留言標為此主題的解答。
點擊此處前往該留言。

引用自 Alan Edwardes:

Hi,

Thank you for reporting this, and thank you rarestMeow for the extra information!

As you alluded to this should be regarded as a false positive, you can see my full response to this in the other thread: https://gtm.steamproxy.vip/app/261820/discussions/0/2272575584128380336/

As I said there, it's something to report to your anti-virus vendor.

Thanks,
Alan

< >

目前顯示第 1-6 則留言，共 6 則

rarestMeow 2020 年 7 月 8 日下午 12:21

hello,

BitDefender is well-known for being quite sloppy and finding viruses where noone else found them - and that case is no exception, just a false positive, as you correctly said. in fact that particular file was already reported as being "suspicious", https://gtm.steamproxy.vip/app/261820/discussions/0/2272575584128380336/

I have opened it up and, well, it is just a regular html+css+javascript file with jquery framework. I guess the part of code that set BitDefender off is that one:

<div id="bsmem" class="bluescreen hide">ARQUEOSERR_0xFFFFFF LOC:<br/><br/>69 20 61 6d 20 65 73 74 72 61 6e 67 65 64 2c 20 69 20 61 6d 20 61 6c 6f 6e 65 2e 20 69 20 61 6d 20 65 73 74 72 61 6e 67 65 64 2c 20 69 27 6d 20 6e 6f 74 20 67 6f 69 6e 67 20 68 6f 6d 65 2e<br/><br/>ACCESS_VIOLATION_HEAP_TRANSPOSE<br/>▮</div>

those HEX-values are look like some malicious code is trying to encrypt itself to protect from being decrypted. I guess BitDefender have found that block, look at it and thought, "hmm. kinda reminds me a shady trojan"

what that code is actually doing is to simulate BSOD effect on a PC which you use to shut down a generator, it looks like this in the game, https://i.postimg.cc/bNsKMG6W/20200708-220732-75073.png

此應用程式的開發人員認為本留言為原主題提供了解答。

Alan Edwardes [開發人員] 2020 年 7 月 8 日下午 12:41

Al Bundy 2020 年 7 月 23 日上午 7:01

Hi, I had the exact same problem with bitdefender and this file.

I checked the folder of that file, and found strange stuff there, pictures and videos of a cat and other things I dont understand.

What made this even stranger is that I got the exact same warning for the same file from bitdefender for another steam game, in another folder. The name of the game is "No more room in hell".
Now I am completly confused, why do I finde this exact same folder with that pseudo-malicious file and other strange stuff (pictures and videos of a cat, picture of an old truck...) in the files of two completly different games ?

To make sure all this stuff has been there for both games right from the installation I uninstalled and reinstalled both games several times.

I have no idea whats going on

rarestMeow 2020 年 7 月 23 日上午 8:03

hello,

引用自 Al Bundy：
I checked the folder of that file, and found strange stuff there, pictures and videos of a cat and other things I dont understand.

in the game "Estranged: Act I" you have to browse through people's e-mails and their PC to find clues how to restart (stop) a generator. those images of cats, trucks and other files are media from people's e-mails and their desktop, in other words they a genuine part of the game

why the very same folder in the "No more room in hell" that's a good question. given both "No more room in hell" & "Estranged: Act I" are Source-based games, I think that this is just a Source SDK shenanigans, nothing special

最後修改者：rarestMeow; 2020 年 7 月 23 日上午 10:27

Al Bundy 2020 年 7 月 23 日上午 8:25

引用自 rarestMeow：
hello,

引用自 Al Bundy：
I checked the folder of that file, and found strange stuff there, pictures and videos of a cat and other things I dont understand.
in the game "Estranged: Act I" you have to browse through people's e-mails and their PC to find clues how to restart (stop) a generator. those images of cats, trucks and other files are media from people's e-mails and their desktop? in other words they genuine part of the game

why the very same folder in the "No more room in hell" that's a good question. given both "No more room in hell" & "Estranged: Act I" are Source-based games, I think that this is just a Source SDK shenanigans, nothing special

ah ok, thanks for the hint. i thought maybe both games are from the same developer or so ...