Search Unity

2017.2 Standalone Player Throwing Malware False Positives?

Discussion in 'Windows' started by StealthyMoose, Oct 25, 2017.

  1. StealthyMoose

    StealthyMoose

    Joined:
    Dec 1, 2016
    Posts:
    6
    So, I have a game launched on Steam (Spooky's Jump Scare Mansion HD Renovation) - as part of a recent update we updated to 2017.2. Users have recently started talking about how they're seeing their antivirus software quarantine the executable. Sure enough, I dropped it in to virustotal and this was the result. I scanned my system to make sure something wasn't sneaking its way in there and everything seems clean.

    In order to further test this I made an empty unity project (single scene named "main", everything else is unmodified default settings). Testing that with virustotal gives this result for an x86 Windows Standalone build and this result for an x86_64 build (my game has the same result with an x86_64 build).

    I suspect this is some part of the new packaging methods to have the very light executable throwing up red flags in these malware detecting systems. Has anyone else had this problem? Has anyone found a way around this problem?
     
    StealthyMoose, Oct 25, 2017
    #1

  2. Tautvydas-Zilys

    Tautvydas-Zilys

    Unity Technologies

    Joined:
    Jul 25, 2013
    Posts:
    10,680
    That is weird. We specifically made this change so we could sign all Unity code (as it was moved into a DLL), and made the executable be very small so it was easy to scan for wrongdoings... I guess something went wrong along the way.

    You could build the executable yourself - we actually ship source code for it in "Editor\Data\PlaybackEngines\windowsstandalonesupport\Source". That might make it different enough for the AV stuff to not flag it.
     
    Tautvydas-Zilys, Oct 27, 2017
    #2

  3. Biohazard90

    Biohazard90

    Joined:
    Jun 20, 2017
    Posts:
    1
    This is now occurring for me as well (using x86 and getting this same result), I take it the antivirus companies have not been e-mailed yet or their false positive submission forms used? The .exe file is not signed - creating a small, statically linked executable is exactly what trips AV 'products' easily, safe for Windows Defender.

    I guess I must hold off with updating to 2017.2 until this has been sorted out.
     
    Biohazard90, Nov 6, 2017
    #3

  4. Tautvydas-Zilys

    Tautvydas-Zilys

    Unity Technologies

    Joined:
    Jul 25, 2013
    Posts:
    10,680
    ^ by the way, I am not ignoring this issue. I'm in process of contacting affected AV vendors.
     
    Tautvydas-Zilys, Nov 7, 2017
    #4
    Biohazard90 and Peter77 like this.

  5. Tautvydas-Zilys

    Tautvydas-Zilys

    Unity Technologies

    Joined:
    Jul 25, 2013
    Posts:
    10,680
    Hey @StealthyMoose I've been testing various 2017.2 versions and uploading our executables to various AV vendors over the last 2 weeks. However, I could not find a version (I probably missed it) where it would fail on McAfee, TrendMicro and AegisLab software. Which exact version of Unity did you use for your first link?
     
    Tautvydas-Zilys, Nov 10, 2017
    #5

  6. monark

    monark

    Joined:
    May 2, 2008
    Posts:
    1,598
    We had the same issue with version 2017.2.0f3 (64-bit)
    I reported this bug to QA but got no response
     

    Attached Files:

    monark, Nov 17, 2017
    #6

  7. Tautvydas-Zilys

    Tautvydas-Zilys

    Unity Technologies

    Joined:
    Jul 25, 2013
    Posts:
    10,680
    What's the case #?
     
    Tautvydas-Zilys, Nov 17, 2017
    #7

  8. monark

    monark

    Joined:
    May 2, 2008
    Posts:
    1,598
    Sorry I accidentally sent it to QA not bugs so no case number at present, I'll resend it
     
    monark, Nov 17, 2017
    #8

  9. monark

    monark

    Joined:
    May 2, 2008
    Posts:
    1,598
    I re-sent it to the bugs@unity3d.com but never received a case number
     
    monark, Nov 20, 2017
    #9

  10. hippocoder

    hippocoder

    Digital Ape

    Joined:
    Apr 11, 2010
    Posts:
    29,723
    Check spam folder but also, any bug reports should go via the bug report tool in the editor.
     
    hippocoder, Nov 20, 2017
    #10

  11. monark

    monark

    Joined:
    May 2, 2008
    Posts:
    1,598
    Third time lucky

    Case 970771
     
    monark, Nov 20, 2017
    #11

  12. Tx

    Tx

    Joined:
    Jul 4, 2012
    Posts:
    108
    We have a similar issue on a game build with Unity 2017.2.2p3.
    AVG,NORTON,AVAST do block the executable. What should we do? @Tautvydas-Zilys do we create a bug report?
    Did you solve your problem @monark?
     
    Tx, Apr 30, 2018
    #12

  13. Tautvydas-Zilys

    Tautvydas-Zilys

    Unity Technologies

    Joined:
    Jul 25, 2013
    Posts:
    10,680
    You have several options:

    1. File a bug report to us and we'll take it to AV vendors;
    2. Send the .exe to AV vendors yourself - most of them have functionality on their website to report false positives.

    While waiting on either you could rebuild the executable yourself, which would change the hash of it and AV software wouldn't flag it anymore. You can find the source code at <UnityInstallDir>\Editor\Data\PlaybackEngines\WindowsStandaloneSupport\Source.
     
    Tautvydas-Zilys, Apr 30, 2018
    #13
    Tx likes this.