koobas.hobune.stream
Unity IAP apparently contains a virus, according to Windows Defender
Hi - we've found that today we can't build our project, because Windows Defender has suddenly decided that /Assets/Plugins/UnityPurchasing/Bin/Stores.dll contains Trojan:Win32/Copordex.C!cl, so it keeps deleting it. This happens with a fresh re-import of the Unity IAP package, and we've found no other viruses on our machines. This started to happen simultaneously on all Windows machines in the studio.
Is this a false positive? Can anyone advise? Thanks!
Well, there are generally two possibilities:
It's either a false positive in which case you may want to contact Microsoft and Unity about that issue
or you actually have some malware on your machine that might specifically infect this DLL.
I would recommend to scan the file online on virustotal or a similar service to get a better scan result. If you are sure that it's a false positive you could temporarily add an exception to the windows defender to make it ignore that file. Though keep in mind if you're not 100% sure i would strongly recommend to not publish builds until this issue has been resolved.
Thanks - I didn't think to look for online virus checking services. I ran the file through a few different ones and it does indeed look like a false positive.
@icejamchriddler It happened to me today as well. Still running a full scanning using Windows Safety Scanner. I will gave you a full report update later.
My Unity IAP seems to be fine (latest version) but I'm having the same problem with a Assembly-CSharp-FirstPass DLL file in the temp folder whenever I try to export a build (the one in the obj which I assume is the original seems to be clean however) causing it to fail and also preventing me from playing in the editor (If I open my project and press play in the editor but don't export a build I don't get any problems). I also found the same trojan in some DLL files in the latest version of GameSpark's Unity SDK (Had to install an older version of the SDK to restore the missing DLLs Windows Defender deleted).
@icejamchriddler I'm here again. With a full report. It is indeed a Trojan Virus. Its not a false positive. Do not, I repeat DO NOT add an exception to Windows Defender. Get a full scan through your hard drive and system, after completion, reboot your system.
Get and download the latest Windows Safety Scanner if necessary. It will help you identify most of the Trojan out there.
@Xanjos The same Trojan type that infect Stores.dll, is attacking several Assembly-CSharp dll files in temp folder. Having a good clean dlls back up file will be nice.
@ray_davis Sorry for the late reply but that really isn't good news at all. Already wasted 8 hours doing both a full and offline scan in Windows Defender (as well as a scan on $$anonymous$$alwareBytes) on my other machine (Surface) to check if it's infected as well (Results seem to say it's clean however). I'll see if an offline scan on the PC that's actually infected will fix the problem (probably what I should have done in the first place) but I'll also do a full scan tomorrow morning since it takes pretty long.
To be fair I don't even know how it got infected in the 1st place. Was it the supposedly dodgy GameSparks Unity SD$$anonymous$$ auto update (I downloaded a fresh version of the Unity package yesterday to check only to find the same trojan infecting the same DLLs from the auto updated version but a slightly older version of the SD$$anonymous$$ I had seemed to be clean when I scanned it) or did I unknowingly download something yesterday/a few days ago that's specifically infecting DLLs in my Unity project folder?
So after 3 days of scanning my PC using everything I had available (scan in Windows Defender Offline, full scan on Windows Defender under safe mode with networking, full on $$anonymous$$alwareBytes under safe mode with networking, full scan on $$anonymous$$icrosoft Safety Scanner under safe mode), my PC apparently seems to be clean so I have no idea what was wrong with it (I'm still doubting that it was a false positive).
@ray_davis @icejamchriddler Do you remember the last thing you did before your antivirus flagged the files (For me it was running the auto updater in GameSparks Unity SD$$anonymous$$ then exporting a build)? Also did you do anything specific to remove whatever was possibly causing the infections on your machine as I'm really at a loss here.
The iMac Customer Service Number is that all regarding for the device you can be rely on of your official Word, That is all the people never to ending customer service to call which can be help the contact us. The Apple iMac customer service Number is available to the support any time help with the contact us.
