I was downloading a mod for a game(Morrowind) and scanned with Avast, it said it was safe. I then put it into VirusTotal just to be sure, and while everything put it in the green, this one AV flagged it:
https://virustotal.com/#/file/c92e5f01e6a2122f49d075b72d98585c78f699d783856d6df834bd955dbd9fa0/detection
What exactly is Virus.Win32.Part.a, is this real or a false positive? Avast and the others didn’t catch this so I wasn’t sure. Can anyone test to see for sure if it’s safe?
Ask the one who flagged it what it means.
They should know.
As it seems it is can be a FP but also a PUP.
I then put it into VirusTotal just to be sure, and while everything put it in the green, this one AV flagged it:And if you then use the additional tabs to find additional file info you will see
So very old. Verdict > False Positive
As only one virus solution has flagged it, this could mean it is a FP.
Re: https://malwr.com/analysis/ZDhkYzNhNmE1YTlkNGY3OWFmZDg5NmZmNzdkNjQ3NmI/
The developer also mentioned one to detect it as a FP: https://i.gyazo.com/5e62170e93a9091d0347165c59d530d1.png
Found on: https://www.reddit.com/r/Morrowind/comments/6uilee/is_this_cloak_collection_14_mod_by_mephisto_safe/
same as we presented at the start of this thread…
See: https://malwr.com/analysis/ZDhkYzNhNmE1YTlkNGY3OWFmZDg5NmZmNzdkNjQ3NmI/
It could be ClassName: ‘InstItClass’ WindowName is being interpreted as an Injection Trojan of sorts (because of the crack executable nature of it). I would be cautious, but also lean to Pondus’s verdict on the executable…
polonus
