Unity IAP apparently contains a virus, according to Windows Defender

Archived Forums Questions & Answers
1

Hi - we’ve found that today we can’t build our project, because Windows Defender has suddenly decided that /Assets/Plugins/UnityPurchasing/Bin/Stores.dll contains Trojan:Win32/Copordex.C!cl, so it keeps deleting it. This happens with a fresh re-import of the Unity IAP package, and we’ve found no other viruses on our machines. This started to happen simultaneously on all Windows machines in the studio.

Is this a false positive? Can anyone advise? Thanks!

The pathStart member does NOT store position nor path information...rather it stores a reference to a Transform object, from which you can get a (single/starting) position. Setting transform.position = pathStart.position WILL assign the object this component is on, the same WORLD position as the pathStart object. If your object has a different position then something else is going on; either you are not assigning the value you expected to (thus my suggestions above on simplifying the code), or the position is being changed after the assignment is done.

 –

3 Answers

3
2

Well, there are generally two possibilities:

  • It’s either a false positive in which case you may want to contact Microsoft and Unity about that issue
  • or you actually have some malware on your machine that might specifically infect this DLL.

I would recommend to scan the file online on virustotal or a similar service to get a better scan result. If you are sure that it’s a false positive you could temporarily add an exception to the windows defender to make it ignore that file. Though keep in mind if you’re not 100% sure i would strongly recommend to not publish builds until this issue has been resolved.

Thanks - I didn't think to look for online virus checking services. I ran the file through a few different ones and it does indeed look like a false positive.

 –

If you're curious, I found out this is a bug in Unity. Having trouble finding the thread again but.. It have everything to do with the animator. The transform couldn't be properly set because the pivot of the gameobject reset after the animator completed it's transition. The fix was to instantiate new GameObjects for the player, setting their transform to the starting point, and then reparenting the player. Regardless, I appreciate your effort. Thank you.

 –
3

@icejamchriddler It happened to me today as well. Still running a full scanning using Windows Safety Scanner.
I will gave you a full report update later.

Hmm.. sounds more like somebody was using world transform components, when they should have been using local transform components.

 –
4

My Unity IAP seems to be fine (latest version) but I’m having the same problem with a Assembly-CSharp-FirstPass DLL file in the temp folder whenever I try to export a build (the one in the obj which I assume is the original seems to be clean however) causing it to fail and also preventing me from playing in the editor (If I open my project and press play in the editor but don’t export a build I don’t get any problems). I also found the same trojan in some DLL files in the latest version of GameSpark’s Unity SDK (Had to install an older version of the SDK to restore the missing DLLs Windows Defender deleted).

@icejamchriddler I'm here again. With a full report. It is indeed a Trojan Virus. Its not a false positive. Do not, I repeat DO NOT add an exception to Windows Defender. Get a full scan through your hard drive and system, after completion, reboot your system. Get and download the latest Windows Safety Scanner if necessary. It will help you identify most of the Trojan out there. @Xanjos The same Trojan type that infect Stores.dll, is attacking several Assembly-CSharp dll files in temp folder. Having a good clean dlls back up file will be nice.

 –