Skip to main content

On Sale: GamesAssetsToolsTabletopComics
Indie game storeFree gamesFun gamesHorror games
Game developmentAssetsComics
SalesBundles
Jobs
TagsGame Engines
(1 edit) (+4)

This is what is called a 'false positive', especially when literally every other antivirus in the list says it is ok.  RenPy games are often false-flagged due to being 'exe packed'.  If you look at the notes it says 'contains elf' and 'contains pe' which point to why it was flagged.  Most antimalware vendors have white-flagged RenPy stuff because they know that it isn't malicious (RenPy being an open-source project) so they know how it works.

If you bothered to throw it into a VM and monitor traffic with wireshark or otherwise ask other trusted techie people before throwing around accusations, then you would look far less foolish here.

Speaking of foolish, repeating what some people from Reddit have (falsely) claimed means you're taking the flak for their bad information.  Again don't believe everything you read.

You can state factually 'I scanned this in Virustotal both exe and zip and some detections came up so I dunno seems sus can anyone verify'.  That means you're concerned over the potential for malware but aren't making accusations without proof.

I've literally called out a certain ported-from-mobile Steam PC release as malware due to a kernel-level spyware driver they install using powershell scripts and claim it as 'anti cheat' (for an offline single-player experience).  Then before I had the opportunity to post a detailed technical breakdown (that I was working on), ReddiTrash and others felt free to plagiarize my work instead (taking credit for the discovery for clicks/karma).

Be vigilant but also be ready to prove what you state.  Since the dev has been active here it is an easy case of 'hey what is this' type of deal.  The dev can mitigate this in some ways since RenPy is open-source and certain features can be enabled/disabled to avoid most false detections.  However, doing so may lead to a much larger file size and a drop in optimization/performance so the tradeoff may not be worthwhile.

(+3)

DaedalusMachina is a legend.

Thanks for the lengthy explanation--I don't know how the nitty gritty works; I'm just here to make otome games LOL


(+1)

Thank you for the kind words.  I didn't mean to just jump into things but I dislike when innocent game devs are falsely accused of malice when they use an open-source project that gets false-flagged by terrible antivirus vendors.  Unfortunately there are many malicious (and ignorant) game devs out there who take advantage of PC and mobile gamers alike and attempt to surreptiously install trojans, spyware, malware, and/or crypto miner software.  The worst I've seen is as I mentioned there are games that attempt to install malware/spyware and claim it is an 'anti cheat' kernel driver.

Although I'm not 100% certain as to ways to mitigate this, there's a few helpful links I found doing a quick search on it:
https://forums.malwarebytes.com/topic/284584-tameit-renpy-game-false-positive/
https://lemmasoft.renai.us/forums/viewtopic.php?t=41570
https://lemmasoft.renai.us/forums/viewtopic.php?t=61332

VirusTotal is not foolproof, nor does it update/configure each antivirus for optimal effectiveness.  There's a correlation between how much money can be made (selling the data to security researchers and companies for example) and the bandwidth/scanning costs associated with doing things 'for free'.  It is a moving target, basically.

As always if anyone gets detections in whatever antivirus/antimalware you use, please be kind enough to at least ask the game developer the what and whys before throwing accusations.  If you are tech-saavy or know someone who is tech-saavy and possibly check network traffic with wireshark or through other methods, then you have a bit more to go on than gut feeling.

If any gamedev comes across this, just know that RenPy is an open-source toolkit for game developers to make visual novel games.  There is no malware involved.  Always get RenPy from the official website: https://www.renpy.org/
That's the DOT ORG  domain, not .com or .net or anything else.  When in doubt, search using a reliable search engine (I use Qwant.com) and then go to the website through that link instead of typing it in directly.