Antivirus Problems

[StEnDi78]

Dear Aslain,
For some time now there have been repeated problems with the modpack being incorrectly identified as a virus. I don't know all antivirus programs, so I'm speaking from my experience with ESET. It is NOT possible for ESET users to temporarily release a file that is classified as potentially dangerous. Even temporarily deactivating the antivirus during installation does not help, because ESET automatically reactivates itself when you try to install such a file. The only option would be to uninstall ESET completely, which is not really an option.

Submitting a file to ESET for review is usually pointless, because by the time this process is complete and the file is released by ESET, the next Aslain version is usually ready and the game starts again from the beginning.

I love the Aslain Modpack and appreciate your work very much, but is there no way to reduce the false detections again? I have generally been very happy with ESET for many years and apart from the Aslain Modpack I have not had any problems. Removing ESET is therefore not really an option and I think many users feel the same way.

I hope a solution can be found.
Dirk.

[Aslain]

I understand the frustration caused by antivirus software like ESET misidentifying the modpack as a potential threat. Unfortunately, false-positive detections are quite common, especially with custom software like mine, which is safe and secure. The issue arises from how antivirus algorithms detect new or less commonly used software, leading to these false alerts. The nature of how the modpack installer works can sometimes trigger antivirus heuristics. The installer might perform actions that, although completely safe, resemble the behavior of certain malware in the eyes of the antivirus software. These programs, particularly those that rely heavily on heuristic detection and AI-based algorithms, might falsely flag the modpack as a threat because they detect patterns that superficially resemble malicious activity.

One potential solution is to purchase a digital signature certificate. While this could help reduce false-positive detections, it's important to note that it solves only part of the problem. Additionally, acquiring and maintaining such a certificate is quite expensive and requires regular renewals, making it less feasible in the long term especially for a free software like mine. Even with a digital signature, there's no absolute guarantee that all antivirus programs, including ESET, will stop flagging the files.

Rest assured, my modpack is entirely safe, and these warnings are indeed false-positive results. If possible, you can try submitting the file to ESET for review, but I understand that this process can take time, and by then, a new modpack version might already be out.

I hope this clarifies the situation a bit more. Unfortunately, there’s no perfect fix for these false detections...

 

[StEnDi78]

Hello Aslain and thank you for the quick reply.
What surprises me is that the antivirus programs have only been recognizing the Aslain Modpack as a false positive for some time. Before, it always worked without any problems with ESET. Has anything changed in the Aslain Modpack in the last few months that is causing these frequent false positive detections?

Please don't misunderstand me, I trust you completely and believe you that there is no virus in your modpack. Unfortunately, modern and secure antivirus software like ESET leaves you no choice and you cannot prevent these files from being blocked unless you uninstall the entire antivirus software.

 

The "Restore and exclude from scan" function is grayed out. When I asked ESET supprt, I was told that you can only manually exclude files that are identified as "potentially unwanted" from further scans, but not files that have been classified as "potentially dangerous". These can only be released after they have been sent in and analyzed by ESET, which unfortunately usually takes quite a long time.

Edited September 30 by StEnDi78

[Aslain]

Before I updated Inno Setup, on a new compiler etc, anyway it totally doesnt matter if before was ok, and now it's triggering your AV. Programs receives updates, either mine, and AV.

 

Check this out too, especially the last post: https://aslain.com/index.php?/topic/28748-update-02-repor

 

 

 

[ArxNiklaus]

Hello Aslain,

 

Yep same issue from Esset (while there was no problem for the last 2 years)

Please check the screenshot below:

https://ibb.co/gJxhjfX

Temporary fix is it create a folder, and add this folder on the exclusion list. It will let you to install the mods

[ArxNiklaus]

I created a post by the way in the ESET forums
https://forum.eset.com/topic/42660-aslain-modpack-for-world-of-warships/#comment-190351

[bluejabba]

Hello Aslain and all  :),

For your information, I also have ESET as my antivirus and I was able to get around the problem by:
1-deactivating ESET
2-downloading the file using the OPERA browser (with Chrome/Firefox this doesn't work).
3-installation ok 🙂
4-reactivate ESET

 

o7

[Capt_Oveur]

Yeah,
So why don't you post on ESET's website? It has nothing to do with Aslain, you are just fearmongering here.

https://support.eset.com/en/kb141-submit-a-virus-website-or-potential-false-positive-sample-to-the-eset-lab#SubmitFile

[Capt_Oveur]

On 9/30/2024 at 3:41 AM, StEnDi78 said:

Submitting a file to ESET for review is usually pointless, because by the time this process is complete and the file is released by ESET, the next Aslain version is usually ready and the game starts again from the beginning.

I submitted a false positive once to BitDefender. I tried to download and install an hour later and it worked

On 9/30/2024 at 8:54 AM, StEnDi78 said:

Unfortunately, modern and secure antivirus software like ESET leaves you no choice and you cannot prevent these files from being blocked unless you uninstall the entire antivirus software.

Anything but modern and secure. ESET LiveGrid and other 'reputational' or AI based systems are basically admissions they got no idea what's going on and until there are many recorded problem free downloads approved by the big AV players they'll block the file in question. 

 

On 9/30/2024 at 3:41 AM, StEnDi78 said:

Removing ESET is therefore not really an option

Why not? Indentured servitude? Digital bondage? Shareholder or employee?

[ArxNiklaus]

I confirm now that the issue with Esset happens when the mod pack is downloaded with Chrome. There is no detection from Esset when this is downloaded with Edge or Opera..

[ArxNiklaus]

For now i got confirmation from ESET that the issue was fixed.

@Aslain for your refference that was the answer below from the admins

Edited 9 hours ago by ArxNiklaus

[Aslain]

I see, so they don't like pastebin. Maybe I can find a different place for those version configs then. I will think about...