Missing Kuids? Post them here.

I got a severe threat detected in KUID3.7z Trojan:Script/Wacatac.B!ml "This program is dangerous and executes commands from an attacker". That was from Windows Defender, so it could be false positive.
 
Could be a false positive? How could it be anything else? It isn`t even executable, save for inside Trainz, and even there, it cannot be what Windows Defender thinks it is, unless it is an infected Native Interface asset, which sounds unlikely.
 
ivomasek said:
Hi Michal
<kuid:553702:11114>,<kuid:307216:120159>,<kuid:553702:11119>,<kuid:553702:11132>,<kuid:553702:11116>,<kuid:553702:11124>,<kuid:553702:11105>,<kuid:553702:80083>,<kuid:553702:80524>,<kuid:431492:5995>

Download:
https://www.uschovna.cz/zasilka/OPWWT9AEKK8VYJ5E-K2Y/7PACM6XIRK
clik of: STÁHNOUT ZÁSILKU

Ivo
Click to expand...
None of the 60 antivirus programs found anything in this archive: https://www.virustotal.com/gui/file...4bdae1bf945c3beba8d2edd5dd94bf258dc?nocache=1
 
Yeah, I don't know what its deal is, but it won't download it. I tried again and got the same result. Just in case others experience the same thing. I don't see any chance to override.
 
these are for Tracksupervisor's NSW Illawarra & Southern Highlands

<kuid:62941:502>
<kuid:62941:16057>
<kuid:429700:100392>
<kuid:429700:100264>
<kuid:62941:16056>
<kuid:62941:16055>
<kuid:141417:27015>
<kuid:59904:777901>
<kuid:429700:100193>
<kuid:429700:100186>
<kuid:155664:2001830>
<kuid:155664:2001820>
 
Forester1 said:
I got a severe threat detected in KUID3.7z Trojan:Script/Wacatac.B!ml "This program is dangerous and executes commands from an attacker". That was from Windows Defender, so it could be false positive.
Click to expand...
My "daily bread" IP scanner tool as I am a network admin is vigorously detected and deleted by not-so-clever MS Defender as a super dangerous virus. I am puzzled as to why would a .7z be marked as dangerous - it is an archive, not an executable. Only if inside is exe then possibly yes, bit not .cdp.
 
Mimes said:
My "daily bread" IP scanner tool as I am a network admin is vigorously detected and deleted by not-so-clever MS Defender as a super dangerous virus. I am puzzled as to why would a .7z be marked as dangerous - it is an archive, not an executable. Only if inside is exe then possibly yes, bit not .cdp.
Click to expand...
Defender, like many antimalware products, will scan inside archives. If malware is detected it'll delete or quarantine the infected file archive and all. It's possible to infect an asset. There is some malware that can infect image files and it's possible that a .tga file or a .png file was infected with something and the asset was trashed by Defender.
 
JCitron said:
Defender, like many antimalware products, will scan inside archives. If malware is detected it'll delete or quarantine the infected file archive and all. It's possible to infect an asset. There is some malware that can infect image files and it's possible that a .tga file or a .png file was infected with something and the asset was trashed by Defender.
Click to expand...
Very true. However, I could not detect anything. That is quite clever from the hackers to target pngs etc. I did not think that was possible. It appears it is.
 
I have always used various antiviruses from various well-known vendors and always got various issues from this. False positives and so on. A few years ago, I decided to get rid of it altogether.
I have removed a third-party antivirus and completely disabled Windows Defender via gpedit.msc.
All the issues and inconveniences went away with the antiviruses and the system working much faster. Nothing strange or suspicious has happened to the system over the years.

Warning: Do not try to do this if you do not have enough experience using a PC!
 
Last edited:
Thank you so much, Ivo, that is very kind of you. It worked fine. Proof that Defender just doesn't like .7z for some reason, although I have plenty of assets stored in .7z.
 
Mimes said:
Very true. However, I could not detect anything. That is quite clever from the hackers to target pngs etc. I did not think that was possible. It appears it is.
Click to expand...
That could've been a false positive. They happen, but yeah images can be infected.
https://gizmodo.com/malware-images-virus-photos-pictures-how-block-antiviru-1849572516

Fonts too and even binary-encoded EPS files. This technique was used to create the "Lino virus" that was aimed specifically at Linotronic imagesetters. These are large, I mean really, really large, film recording devices used to produce films for the printing industry. I can't find a link to any information on this one, thanks to the polluted search engines using directed searches, but it caused quite a stir in the early 90s.

The thing is any file containing binary data can be infected. Scary stuff!
 
oldman777 said:
I have always used various antiviruses from various well-known vendors and always got various issues from this. False positives and so on. A few years ago, I decided to get rid of it altogether.
I have removed a third-party antivirus and completely disabled Windows Defender via gpedit.msc.
All the issues and inconveniences went away with the antiviruses and the system working much faster. Nothing strange or suspicious has happened to the system over the years.

Warning: Do not try to do this if you do not have enough experience using a PC!
Click to expand...
Yes, the machines definitely run faster but there's still that risk that something can get in. It's not that you aren't careful in your browsing habits and work carefully, what used to be a safe website could be infected. Recently, as people have reported here, once safe Trainz-content websites are infected with droppers or some other malware that can then infect your system.
 
JCitron said:
Yes, the machines definitely run faster but there's still that risk that something can get in. It's not that you aren't careful in your browsing habits and work carefully, what used to be a safe website could be infected. Recently, as people have reported here, once safe Trainz-content websites are infected with droppers or some other malware that can then infect your system.
Click to expand...
Can you give me some links to such infected sites? I really like experiments and I want to go to these sites and personally verify the existence of such threats.
 
MasterTracklayer said:
Now that is literally asking for trouble. I hope you don`t regret it.
Click to expand...
I was obviously misunderstood, this is not bravado or thoughtlessness.
I always know with confidence what I'm doing or not doing it at all. I just want to help those who do not have self-confidence, tell them how to distinguish a fake site from a real one and what not to do to get into trouble.

That is why I wrote in my first message regarding this:

Warning: Do not try to do this if you do not have enough experience using a PC!
 
Last edited:
You must log in or register to reply here.

Similar threads

R
Whiteshore Dependencies
Replies
5
Views
205
sultan1966
S
J
Looking for some missing Kuids for Yosemite valley V2
Replies
0
Views
340
j0yes
J
R
NEC missing deps.
Replies
3
Views
613
MarylandRailfan6000
M
S
How to recover HD space even after deleting unwanted assets?
Replies
12
Views
381
JCitron
J
T
Unknown kuids (Northeast corridor route)
Replies
0
Views
109
Thutu003
T
Back
Top