Decker

A multimedia sketchbook · By Internet Janitor

Add to collection

tool Community Devlog

Decker community

Update might be infected with an infostealer???? Help?????

A topic by dimsword35 created 24 days ago Views: 136 Replies: 2

Viewing posts 1 to 2

dimsword3524 days ago

So, i was going to use decker for like, five minutes, like i usually do, and i noticed that a new update had dropped recently, so i downloaded it and replaced the files on the old decker version with the new one, and tried to run it. It returned an error saying something along the lines of "This application contains a virus or does something potentially unwanted, so it has been prevented from running", and i thought that was weird, and then i tabbed out into Firefox so that i could upload the exe to virustotal, and only two antiviruses had flagged it as malware, plus nothing on the behavior tab seemed sus, but eventually windows defender also flagged it as malware, so i deleted the file, and the zip it came in. I also checked my system with SysInternals' Autoruns and ProcExp and i didn't see anything sus either. I am still a bit afraid that my info was stolen so i will be changing my email passwords just in case. Can somebody tell me what caused this to happen? I am afraid and confused :/

ahmwma24 days ago (1 edit) (+3)

First step: Breathe. Hang in there.

If there was a problem, the program already "has been prevented from running" by whichever Windows service stopped it.

I suspect that there's no problem at all -- which is good news for your personal info! I know from experience that Windows Defender tends to block most independent software (and each new version of that software, every time) when you first try to run them. It's usually not difficult to tell it to let the program run anyway if you know what it is and if you trust the source of the files.

(I don't mind having to tell Windows that my usual open-source programs are okay if it keeps weird mystery programs from running on my Grandma's laptop, y'know?)

In this case the phrase "or does something potentially unwanted" may just be Decker's ability to create deck files. Creating new files would be worrying if it was actually some kind of malware, but in the case of creative software it's quite necessary to be able to save your work.

For what it's worth, I had Windows Defender scan my copies of Decker 1.52 as a program and in it's zip that I downloaded here on itch.io and it didn't find anything suspicious or unusual. And despite finding nothing weird it still prevented the new version of Decker from running the first time I tried to open it. Because it always does. And I told it to "Run anyway", as always. And everything about Decker 1.52 seems completely fine and normal here.

It's good to be safe! It's a very good practice to change your email passwords occasionally, whether or not there's a problem. But I think there probably isn't one this time.

If you're still concerned, you can always build Decker from source. Here's the link to Decker's GitHub.

dimsword3523 days ago(+1)

Thank you for your detailed reply! I just got a bit paranoid as I didn't get this error on earlier versions of decker, lol. I think I'll try downloading it again, thanks!