Windows Defender reports M-2000C\bin\M2KC_FM.dll is a PUA:Win32/Packunwan

[Ithronwise]

Hi folks,
after the latest DCS update the Windows Defender reports DCS World\Mods\aircraft\M-2000C\bin\M2KC_FM.dll is a PUA:Win32/Packunwan.
Timestamp of the file has changed with the update and also its size but there is no patch note about the Mirage 2000C in the release notes.

Edit: VirusTotal Scan added

Edited May 9, 2024 by Ithronwise

[Rudel_chw]

Most likely a false positive ... if it were a real virus the Forum would be all over with virus alerts from other users which updated as soon as the DCS patch released.

[Athlonic]

Same issue here.

Happened just after I updated to last version.

[Rudel_chw]

3 minutes ago, Athlonic said:

Same issue here.

Happened just after I updated to last version.

 

I also employ MS Defender, but I have excluded the DCS folder from the AV action, as since DCS started to encrypt its content, the amount of False AV reports increased so much that it got kind of annoying.

Edited May 9, 2024 by Rudel_chw

[Ithronwise]

1 hour ago, Rudel_chw said:

Most likely a false positive ... if it were a real virus the Forum would be all over with virus alerts from other users which updated as soon as the DCS patch released.

Probably, but because of my job I am highly alerted if I get such a report, especially if more than one or two scanners on VirusTotal report an issue. 

The file has been changed by the update but there is no information about any M-2000C patches in the release notes. That triggers my professional paranoia. 

I have uninstalled the Mirage 2000C module until further notice. 

[Rudel_chw]

58 minutes ago, Ithronwise said:

I have uninstalled the Mirage 2000C module until further notice. 

wow, just wow, I have no words  … on my case, I employ my PC just for gaming, so the damage that an eventual virus or malware can do is very limited, my e-mail and web browsing and purchasing is done on my other computer (an iMac) or on my iPad, the PC is strictly for playing.

[Fulcrumkiller31]

Same for me. Uninstalling M2k. 

 

Cant seem to remove it which is very suspicious 

Edited May 9, 2024 by Fulcrumkiller31

[maxTRX]

1 hour ago, Ithronwise said:

Probably, but because of my job I am highly alerted if I get such a report, especially if more than one or two scanners on VirusTotal report an issue. 

The file has been changed by the update but there is no information about any M-2000C patches in the release notes. That triggers my professional paranoia. 

I have uninstalled the Mirage 2000C module until further notice. 

I don't blame you...  files that changed didn't trigger alerts, file that wasn't supposed to be changed did.  I'm not a professional but I'm up to my ears into this stuff... sort of fascinating

I'm on a stricktly gaming rig so... I can drop my firewall, let my pass-through cam in VR and sound feed straight to zuckerberg so he can see my secret moves and tactics.

[Ithronwise]

12 hours ago, oldcrusty said:

14 hours ago, Ithronwise said:

Probably, but because of my job I am highly alerted if I get such a report, especially if more than one or two scanners on VirusTotal report an issue. 

The file has been changed by the update but there is no information about any M-2000C patches in the release notes. That triggers my professional paranoia. 

I have uninstalled the Mirage 2000C module until further notice. 

Expand  

I don't blame you...  files that changed didn't trigger alerts, file that wasn't supposed to be changed did.  I'm not a professional but I'm up to my ears into this stuff... sort of fascinating

Not sure what do you want to say. The alert pops up, when dcs starts. Didn't happen before the update. So, some function within the dll has changed and triggers the Windows defender now as soon as it is read by the dcs.exe.

The different file size and timestamp shows the file was changed by the update. 

Edited May 10, 2024 by Ithronwise

[Ithronwise]

14 hours ago, Rudel_chw said:

wow, just wow, I have no words  … on my case, I employ my PC just for gaming, so the damage that an eventual virus or malware can do is very limited, my e-mail and web browsing and purchasing is done on my other computer (an iMac) or on my iPad, the PC is strictly for playing.

I guess, your gaming pc is connected to your home network? So, in this case if you catch a malware (a backdoor for example) on this pc you have good chances that your other devices within this network will be compromised, too. As soon as someone has access to one device within your network you are lost.

[cfrag]

14 hours ago, Rudel_chw said:

wow, just wow, I have no words

TBH, one immediately came to my mind: "good!"

The facts are that OP downloaded some data from a source of unknown repute (a.k.a ED's servers in Russia). If that trips a major Malware detector, that calls for immediate action: OP should scratch the offending bits, and ED should respond quickly to prevent a small glitch turn into a conflagration (reputation-wise; I also suspect that this is a false positive. If not, they must already be at an all-hands-on-deck status). I'm a bit surprised that we do not have some official word on this from ED, and I hope we will soon. 

[silverdevil]

17 hours ago, Ithronwise said:

Hi folks,
after the latest DCS update the Windows Defender reports DCS World\Mods\aircraft\M-2000C\bin\M2KC_FM.dll is a PUA:Win32/Packunwan.
Timestamp of the file has changed with the update and also its size but there is no patch note about the Mirage 2000C in the release notes.

Edit: VirusTotal Scan added

to help others and yourself, you should submit the offending files to Microsoft. false positives do happen. you being a professional should always do this. ED is merely going to tell you there is no worry. this in itself should not alleviate your worries.

https://www.microsoft.com/en-us/wdsi/filesubmission

by the way AV software slows loading times significantly.

[Ithronwise]

1 hour ago, silverdevil said:

to help others and yourself, you should submit the offending files to Microsoft. false positives do happen. you being a professional should always do this. ED is merely going to tell you there is no worry. this in itself should not alleviate your worries.

You are right, but these dll's are encrypted. So Microsoft will not be able to check if there is a potentially harmful function in it or not. These files are only decrypted during their runtime by the dcs.exe and that's the moment where the Windows Defender can check the functions in it that are loaded into the RAM.

Edited May 10, 2024 by Ithronwise

[maxTRX]

6 hours ago, cfrag said:

TBH, one immediately came to my mind: "good!"

The facts are that OP downloaded some data from a source of unknown repute (a.k.a ED's servers in Russia). If that trips a major Malware detector, that calls for immediate action: OP should scratch the offending bits, and ED should respond quickly to prevent a small glitch turn into a conflagration (reputation-wise; I also suspect that this is a false positive. If not, they must already be at an all-hands-on-deck status). I'm a bit surprised that we do not have some official word on this from ED, and I hope we will soon. 

Word or no word from ED... we shall continue 'has to be a false positive' approach and keep flying .  Who knows how these updates are shlepped together and where.  One thing for sure is that they are never thoroughly tested for bugs... Is the whole package ever tested for integrity and where, before it hits the d/l servers?  Oh well

[SirBenn21]

Same Here.

[silverdevil]

11 hours ago, Ithronwise said:

You are right, but these dll's are encrypted. So Microsoft will not be able to check if there is a potentially harmful function in it or not. These files are only decrypted during their runtime by the dcs.exe and that's the moment where the Windows Defender can check the functions in it that are loaded into the RAM.

fair enough. though how does defender know that it is bad if it cannot unencrypt it cannot tell either way? isolate your machine and run wireshark to inspect the packets being sent from your network.

its your choice and i respect your choice.

[mazex]

Defender on Windows 11 finds the same thing with packunwan in "\Mods\aircraft\M-2000C\bin\M2KC_FM.dll" on my computer after running the update today. 

Uninstalling the Mirage 2000 immediately. Really sloppy to push ad/spyware in an official release (unless it's a false positive that is on Microsoft) - but I do not take any chances. Does not seem like a virus but does not matter.

Edited May 11, 2024 by mazex

[fifi49000]

Bonjour à tous même problème ici pour M2000 !  Qui semble être un faux positif , mais un doute reste évidement... J'espère qu'il y aura un correctif prochainement car sur une version officielle ça fait désordre... 

[Ithronwise]

13 hours ago, silverdevil said:

fair enough. though how does defender know that it is bad if it cannot unencrypt it cannot tell either way? isolate your machine and run wireshark to inspect the packets being sent from your network.

dcs.exe starts -> loads the dlls into the RAM -> decrypts them there and executes the contained functions -> Windows Defender finds there is something suspicious -> Alert

My machine is alright, otherwise I would have the wrong job. The dll is the problem and even if it is a false positive alert it isn't my task to clear this issue with Microsoft, but ED's.

Edited May 11, 2024 by Ithronwise

[scopewizard]

[draconus]

On 5/9/2024 at 5:37 PM, Ithronwise said:

Timestamp of the file has changed with the update and also its size but there is no patch note about the Mirage 2000C in the release notes.

Afaik this is normal since the modules need their files updated (1 dll and 1 manifest) to the new DCS version with every update, no matter if there were any additions/updates/fixes to the module itself.

Also "potentially unwanted" comes from heuristic engines check.

Edited May 16, 2024 by draconus

[Espectro]

Same issue here using Norton:

 

[Hammer1-1]

I mentioned this issue about 2 weeks ago trying to troubleshoot why DCS kept crashing. This is a well known issue at the moment.

[BJ55]

Probably the digital signature has become invalid/outdated and the M2000 dll's are considered unsafe.

Edited May 23, 2024 by BJ55

[AJaromir]

It's blocked by reputation-based protection. I have this report for Harrier. What is sus that yesterday there had been no report.

Edited June 3, 2024 by AJaromir