Possible false positiv

Yesterday I opened an official modpack on curse forge called All The Mons version 0.17 something, the version before the latest.

When I opened it bitdefender went off saying I had a trojan generic. All files flagged were related to the mod crash assistant.

C:\Users\name\curseforge\minecraft\Instances\All the Mons - ATMons\mods\CrashAssistant-neoforge-1.20.6-1.21.4-1.11.6.jar is infected with Trojan.GenericKD.79893365 is what bitdefender shows me as the file path for the original alert.

Find more posts tagged with

malware false positive

trojan

Comments

PastelT

Something else to note is that I haven't open my PC since yesterday, I couldn't figure out if it was false positive so I disconnected from Internet and turned my pc off

Alexandru_BD

Hi,

I think this does look like it could be a false positive, especially since the detection appears tied to the crashassistant JAR included with an official modpack.. The sure way to find out would be to submit a sample to the Bitdefender Labs using the form available at the link below:

https://www.bitdefender.com/consumer/support/answer/29358/

It also helps to mention that the file came from the official modpack and to include the specific mod/file name.
I would recommend not restoring or running the detected file until it has been checked.

Hope this helps.

Regards

PastelT

I've avoided connecting my PC back to the internet, if I can't use my PC to go to that how do I upload the file or anything without being able to reinstall the pack or restore the file or connecting to the Internet until I know if it was a false positive or not

Alexandru_BD

If Bitdefender is up and running, then it will not let anything malicious execute on the device and since it returned an alert, this means it has blocked the possible threat. So, I think you can power on your PC and connect to the internet now. Here's what actually happens when Bitdefender detects an infection:

https://www.bitdefender.com/consumer/support/answer/2576/

If you are reluctant to connect to the internet, then perhaps you could create a backup for all your assets before that, but that's really a precautionary step and best practice in general.

Alexandru_BD

One more thing to keep in mind here, the Bitdefender security modules are designed in a specific way, so that IF a defense fails, another one takes its place.
For example, the firewall prevents the infection from entering the PC from the network, if the firewall fails, Advanced Threat Defense takes over and blocks dubious processes. If this module misses something, then the Antivirus will find any modification of files during scanning.

Alexandru_BD

I guess you'll just have to check if there's a way to get that file again safely and submit it to Bitdefender Labs.
You don't have to open, execute or unpack anything, just get the modpack and use that form to attach the whole file.
Otherwise, there's not much we can do here…