So got a nasty surprise today in my SCANSAT mod that I downloaded from CKAN

[reschke]

Scansat was found to contain a trojan....its contained but it was effecting my KSP installation and really isn't a good thing. Glad all my virus/malware software picked it up as I was attempting to run KSP for the first time in a few weeks and had just downloaded the SCANSAT mod.

https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Azden.B!cl

[Atkara]

Downloaded from Github, scanned it with ESET Smart Security and no files are showing up as infected. Are you sure it's not a false positive?

Edited November 5, 2017 by Atkara

[HebaruSan]

Minor correction to the title: You downloaded that from SpaceDock, not CKAN. CKAN does not host its own downloads.

[Tw1]

1 hour ago, HebaruSan said:

You downloaded that from SpaceDock, not CKAN. 

 

And there's your problem right there. I thought SpaceDock was dead?

[ZooNamedGames]

3 hours ago, Tw1 said:

 

And there's your problem right there. I thought SpaceDock was dead?

You might be confusing it with * which I dead. Spacedock is still running.

That said; Norton often detects files as “suspicious” without much warning or reason and quarantines them. Despite some files coming from popular and frequently used mod listings.

[katateochi]

Also scanned (both github and spacedock hosted versions) with ESET NOD32 and no threats found. 

4 hours ago, ZooNamedGames said:

That said; Norton often detects files as “suspicious”

Indeed. Not wanting to get into a which-AV-is-better argument, but there's a reason I don't use Norton anymore. 

[Geonovast]

28 minutes ago, katateochi said:

Also scanned (both github and spacedock hosted versions) with ESET NOD32 and no threats found. 

Indeed. Not wanting to get into a which-AV-is-better argument, but there's a reason I don't use Norton anymore. 

Last time I touched Norton, it was to remove it.  My mom's subscription ran out, and conveniently, at that very moment, she caught a virus that disabled her browser and redirected all page requests to... a page to renew her Norton subscription.  Funny how uninstalling Norton also removed that particular virus.

[Jas0n]

Something I did to prevent false positives like that is to whitelist the KSP folder.

[Atkara]

2 hours ago, Geonovast said:

Last time I touched Norton, it was to remove it.  My mom's subscription ran out, and conveniently, at that very moment, she caught a virus that disabled her browser and redirected all page requests to... a page to renew her Norton subscription.  Funny how uninstalling Norton also removed that particular virus.

I don't know how Norton and McAfee antivirus suites are today, but back in the day, they were using way too much RAM for my taste. In the case of Norton, it would root itself so deep into the registry that I could've sworn the thing was a virus itself. After discovering ESET, I never looked at either of these two, ever again.

[Cpt Kerbalkrunch]

2 hours ago, Geonovast said:

Last time I touched Norton, it was to remove it.  My mom's subscription ran out, and conveniently, at that very moment, she caught a virus that disabled her browser and redirected all page requests to... a page to renew her Norton subscription.  Funny how uninstalling Norton also removed that particular virus.

I'm pretty sure Norton's only reason for existence is to convince you to pay for its further existence.

[Kerbinchaser]

12 hours ago, Tw1 said:

 

And there's your problem right there. I thought SpaceDock was dead?

Are you thinking of *?

[reschke]

Well it came through when I was using CKAN...don't know where it pulled from and don't care since CKAN porked my installation of KSP 3x in 3 days so I am back to the good old fashioned using downloaded mods from other places methods.

Anyway still having the same issue with Spacedock, Curse and Github versions....think I am going to disable Defender and run it anyway since it seems to be a false positive.

[Archgeek]

On 11/5/2017 at 1:48 PM, Lo Var Lachland said:

Are you thinking of *?

*?  Is there a wordfilter on spaceport, or whatever the elder one was called?

[HebaruSan]

I think they mean:   K e r b a l S t u f f

Which the forum renders as "*"

[Kerbinchaser]

1 hour ago, Archgeek said:

*?  Is there a wordfilter on spaceport, or whatever the elder one was called?

I don't know how that got there. I meant to say Kerbal Stuff. Maybe I typoed and it got censored, or something? 

Edited November 8, 2017 by Lo Var Lachland

[Kevin Kyle]

Remember Norton Anticrash? It caused more crashes than windows did. lol

 

Actually, that might have been on the Amiga. Cant remember for sure, its been a while.

Edited November 8, 2017 by Kevin Kyle

[HebaruSan]

Regarding the web site which can no longer be named:

 

[Archgeek]

3 hours ago, Lo Var Lachland said:

I don't know how that got there. I meant to say Kerbal Stuff. Maybe I typoed and it got censored, or something? 

Ah, #justKerbalThings, got it.  I remember that one, it got badly compromised.

2 hours ago, Kevin Kyle said:

Remember Norton Anticrash? It caused more crashes than windows did. lol

I...may've misread that as Norton Antichrist.  Which is really not quite as hyperbolic as it oughta be.  ...All those innocent boxes wrecked by SystemWorks back in the day.

1 hour ago, HebaruSan said:

Regarding the web site which can no longer be named:

 

Welp that explains that, it was the one that got hijacked (registration-sniped, severely compromised, or outright stolen?  I forget.)  Now if only I could remember the old old one that used to have an in-game link, that I think squad hosted themselves for a time.

[Gordon Fecyk]

What was the component flagged as malware? As of right now the SCANsat download for KSP 1.3.1 on spacedock.info appears clean to WD built into Release 1703 , and I leave auto-updates turned on.

[Snark]

Moving to Add-on Discussions.

[Bottle Rocketeer 500]

19 hours ago, Lo Var Lachland said:

I don't know how that got there. I meant to say Kerbal Stuff. Maybe I typoed and it got censored, or something? 

Let's see. * Yes, it renders * as *.

Edited November 9, 2017 by Bottle Rocketeer 500

[Nightside]

Hi, the same thing happened to me a month or so ago with Scansat and Windows Defender and i assumes it was a false alarm. I mentioned it to @DMagic, you might mention it in the GitHub issue I started. A reinstall fixed the problem but it is strange that it happened again.