AV Error: "TieDynamicCockpits_v2.0.exe manifests ransomware behavior and was blocked"

[nww02]

Upon attempting to run the Tie Dynamic Cockpits installer, my AV reported it detected that the application was attempting to adapt and encrypt several system files. One of these was C:\ProgramData\NVIDIA Corporation\Drs\nvdrssel.bin .

I can't see why a patch for a game should need to alter a file in ProgramData, so I've blocked it.

The full error:

The process C:\Users\Thrawn\Downloads\TieDynamicCockpits_v2.0.exe manifests ransomware behavior and was blocked. Several files were encrypted but we successfully restored all of them. You can find the restored files list below....


Just FYI.

[Driftwood]

That's strange, what antivirus are you using?

Historically with this project any virus warnings are all false positives.

[Forceflow]

That installer should not touch anything outside of the XWA directory. I am pretty sure that when I last used it, it didn't do anything else. It might be a false positive, though it seems to be a bit specific for that.

Could you check the MD5 checksum of the installer in the windows command-line:

Code: Select all

CertUtil -hashfile <path to file> MD5/[code]

[Forceflow]

Upon attempting to run the Tie Dynamic Cockpits installer, my AV reported it detected that the application was attempting to adapt and encrypt several system files. One of these was C:\ProgramData\NVIDIA Corporation\Drs\nvdrssel.bin .

I can't see why a patch for a game should need to alter a file in ProgramData, so I've blocked it.

The full error:

The process C:\Users\Thrawn\Downloads\TieDynamicCockpits_v2.0.exe manifests ransomware behavior and was blocked. Several files were encrypted but we successfully restored all of them. You can find the restored files list below....


Just FYI.

This is the result you should get with CertUtil:

Code: Select all

CertUtil -hashfile "TieDynamicCockpits_v2.0.exe" MD5
MD5 hash of TieDynamicCockpits_v2.0.exe:
4a805a0d244a19a139b79a5fc70c8399
CertUtil: -hashfile command completed successfully.

If this is the same file then I really don't know why your AV reports this. I've installed it on my PC and several other members have as well. No one mentioned anything about it being corrupt or infected.

[capitanguinea]

It could be a dormant virus who operates when another software uses installshield. You have to track back exactly what files were active during installation. If you detect anomalies in files not in use by a program you have your suspectm