csgo_richpresence icon indicating copy to clipboard operation
csgo_richpresence copied to clipboard

Trojan warning

Open tooruu opened this issue 7 years ago • 9 comments

Why should I trust this software? capture

tooruu avatar Jul 30 '18 18:07 tooruu

CAN CONFIRM: I have a PhD in Holistic Software Development and this software is HIGHLY MALICIOUS! It has deleted all my softwares and PERMANENTLY damaged my graphics card!!! Don't worry though, I have been on-call with this very helpful man from India who is offering to repair it and salvage all my data for the low low price of $300 an hour.

PS please stop using computers

tizbobby avatar Jul 30 '18 18:07 tizbobby

Because it's open source? You can check the code yourself for any malicious behaviour.

If anything, this is probably because the script:

  1. scans open processes (checks if CSGO is open)
  2. communicates through named pipes (kind of tricky stuff)
  3. is awfully coded, this is my first Python script

I have been planning to make a better version of this in JavaScript / Electron as I am much more accustomed to it, and to archive this repository because it is full of issues, but I've been busy with a Discord Bot.

Tenrys avatar Jul 30 '18 18:07 Tenrys

Can't you just upload fake source code to GitHub? I'm sorry if I sound stupid, I just don't believe everything I see. Tell me how GitHub works.

tooruu avatar Jul 30 '18 18:07 tooruu

Well, I can. But that's not what I did. You don't need the .exe anyway, I did it for convenience but I realize that's really not a good way to do this. I understand how it gets marked as malicious: Unsigned packed python exe that adds itself to startup.

Tenrys avatar Jul 30 '18 18:07 Tenrys

I didn't use the installer tho. Do both exe files add this to startup?

tooruu avatar Jul 30 '18 19:07 tooruu

Installer does.

Tenrys avatar Jul 30 '18 19:07 Tenrys

Installer was the exe which did not catch attention of Windows Defender

tooruu avatar Jul 30 '18 19:07 tooruu

The program is flagged by windefend's detection (Trojan.Win32.Agent.qwghzv on my Kaspersky Internet Security 18) because it sets itself to auto-start with Windows. This is the well-accepted way of doing it, and it can get flagged as malware, but it is not. You can instead run the program from the source code using Python, which will not cause it to raise alarms.

uwx avatar Jul 30 '18 19:07 uwx

Well, whatever

Tenrys avatar Jul 30 '18 19:07 Tenrys