Version 2.7.3.3 Update in ACT shows supposed malware being downloaded

[StarcallerJae]

Specifically, Trojan:Win32/Kepavll!rfn

[Schnoofles]

Latest version is also being flagged by Eset's NOD32 (fully updated, detection engine version 31094, dated 2025/04/25), listing the detected threat as Win64/HackTool.RustRegion.C

[nep63]

My computer won't even let me download it since it thinks it's a virus

[Mentaelis]

Same issue, on windows 10. Downloading from ACTs own site causes the same issue. Defender detects it as a virus.

[warmybear]

Same. Can't download the parsing plugin because everything thinks its a virus to the point of not letting me do anything with it. Hopefully the issue is fixed soon

[DhakaWolf]

Same issue, Windows 11 24H2

Was able to work around it by disabling Defender AV temporarily:

1. Open the Windows Security app
2. Under Virus & threat protection, click "Manage settings"
3. Turn off "Real-time protection"
4. Update the plugin using ACT as normal
5. Turn on "Real-time protection"

[cptroot]

DO NOT under ANY circumstances disable Defender to continue using ACT.

[DhakaWolf]

DO NOT under ANY circumstances disable Defender to continue using ACT.

Temporarily. Just download the plugin and enable immediately afterwards.

[CordeliaMist]

DO NOT under ANY circumstances disable Defender to continue using ACT.

Temporarily. Just download the plugin and enable immediately afterwards.

They are trying to tell you that you never know what code is or isn’t included in the release .exe / .dll that is or isn’t in the open source code.
Until verified, you should never trust any code flagged as malware unless proven otherwise.

Just because it is what you once knew as a safe ACT, does not mean it is the same safe ACT after the code becomes flagged as malware after a merge pull request and new update. Wait for it to be fixed, do not just “allow the malware to download”

[EQAditu]

Just because it is what you once knew as a safe ACT, does not mean it is the same safe ACT after the code becomes flagged as malware after a merge pull request and new update. Wait for it to be fixed, do not just “allow the malware to download”

This is the source code to the file being flagged: https://github.com/ff14wed/deucalion
Look at it all you want. I'm pretty sure there are no plans to make another build just to "evade" bad detections. The library is up front about what it does and some companies call that a HackTool or PotentiallyUnwantedApplication.

Keep in mind that ACT, the FFXIV parsing plugin and deucalion are all made by a different person each. Make sure you understand that distinction when you decide what to trust or not.

[CordeliaMist]

Just because it is what you once knew as a safe ACT, does not mean it is the same safe ACT after the code becomes flagged as malware after a merge pull request and new update. Wait for it to be fixed, do not just “allow the malware to download”

This is the source code to the file being flagged: https://github.com/ff14wed/deucalion Look at it all you want. I'm pretty sure there are no plans to make another build just to "evade" bad detections. The library is up front about what it does and some companies call that a HackTool or PotentiallyUnwantedApplication.

Keep in mind that ACT, the FFXIV parsing plugin and deucalion are all made by a different person each. Make sure you understand that distinction when you decide what to trust or not.

Thank you for the clarification and source flag identifier. I also apologize if my reply seemed to be directing the issue at your code, I should have said "safe Code" over "safe ACT"

[EQAditu]

VirusTotal suggests that Microsoft now considers this as PUA:Win32/GameHack with at-rest scanning. So soon temporarily disabling real-time protection to install it will not be enough. You will need to add an exception. You should already know this is a game hack, so Microsoft will likely not change their determination but at least they are honest.

[DhakaWolf]

Makes sense, I had tried doing the exclusion to do the download at first and had no luck so that tracks.

[warmybear]

VirusTotal suggests that Microsoft now considers this as PUA:Win32/GameHack with at-rest scanning. So soon temporarily disabling real-time protection to install it will not be enough. You will need to add an exception. You should already know this is a game hack, so Microsoft will likely not change their determination but at least they are honest.

at the risk of asking a stupid question, is deucalion at all the sort of thing Microsoft would somehow normally flag or is this just random Microsoft bs?

[EQAditu]

It's possible that a random user submitted the file to Microsoft asking for the Trojan flag to be removed and the Microsoft employee decided to give it this new determination manually.

[steakwipe]

looks like a lot of AVs are flagging it, mostly with generic flags. idk if this is any help just thought i'd throw the zip at virustotal to take a peek

https://www.virustotal.com/gui/file/70411b861a0e7a1f9e44bb6a3091bc24443eb009fd6b810402f5802078926f64