"HackTool: Win32/Crack! MTB"

[MildlyPassives]

When attempting to launch with this mod on Thunderstore or R2modman I get a virus warning that says "HackTool: Win32/Crack! MTB"

[Bkerboy314]

I can't even download it

[leoerwan]

well i can report to you that this is in fact... malware... i have 4 antiviruses all flagging it, windows defender went crazy and started scanning out of nowhere, and even as a zip it got quarantined and removed..

if you want proof here it is

Honestly idk about you, but if i see this... i wont even dare to unzip it...

[x753]

The Unreal Shimloader is not malware, this is a false positive. It is open source which means you can look at the code, see what it does, and build it yourself.

Modding tools are frequently reported as false positives, especially when written in languages like Rust or if they need to interact with system processes. If you look at the "BEHAVIOR" tab on VirusTotal, you can see what the shimloader is accessing on your computer as well as any other networks it's contacting or processes it's creating.

[leoerwan]

alright explain why every antivirus is flagging it?

and why are they all saying its the exact same files?

i dont trust it and never will...

[leoerwan]

its also very interesting that even with the source... it flags the exact same file...

[x753]

its also very interesting that even with the source... it flags the exact same file...

Trojan:Win32/Vigorf.A is not a file itself, but a pattern found in one of the files. The actual file that this pattern is found in is dwmapi.dll, and the main reason it is being flagged is because:

Matches rule Potential System DLL Sideloading From Non System Locations by Nasreddine Bencherchali (Nextron Systems) at Sigma Integrated Rule Set (GitHub) Detects DLL sideloading of DLLs usually located in system locations (System32, SysWOW64, etc.).

dwmapi.dll is a file normally found in Windows system files. Using it for anything like this will usually flag it in antivirus software, even if you're doing something harmless with it.

[JarzaCode]

alright explain why every antivirus is flagging it?

and why are they all saying its the exact same files?

i dont trust it and never will...

gotta love blindly trusting AV (without understanding what it's even saying, mind you) without even looking at source code.

[smultar]

alright explain why every antivirus is flagging it?

and why are they all saying its the exact same files?

i dont trust it and never will...

No one is forcing you to use this. This behavior is standard for any software that modifies existing code. Mods and game modifications typically trigger these warnings because they aren't code-signed. The system is just doing its job by alerting you to potential tampering—it's a security feature, not a bug. Any technically informed person would understand that this is normal for modification tools.

[Elderon-TD]

in some defense, I had Windows Defender flagging the very same DLL file just for the vanilla version of VoTV in the old 0.6.3 build without any mods when i tried loading it up and realizing I was severely outdated