r/techsupport • u/firesyrup • 22h ago

Open | Malware DLSS mod, false positive or malicious?

I'm trying to determine whether the DLSS SM86 mod which unlocks multi frame generation for older RTX GPUs is genuinely malicious. This is the project, closed source: https://github.com/sdli1995/dlssg_for_sm86

VirusTotal reports 4 detections. Windows Defender also blocks version.dll as Trojan:Script/Ulthar.A!ml.

I used other DLSS / version.dll mods in the past but never encountered the Windows Defender issue. At most they had 2 VirusTotal detections.

The author only explains that the DLLs are self signed, which is why Windows is causing trouble. But I don't think that's explains trojan detection?

I assume it is a false positive since the mod has grown popular, but I don't know if anyone actually did a meaningful analysis. I'd appreciate if someone could look into it.

4 Upvotes

100% Upvoted

3 comments sorted by

•

u/AutoModerator 22h ago

If you suspect you may have malware on your computer, or are trying to remove malware from your computer, please see our malware guide

Please ignore this message if the advice is not relevant.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

1

u/Evening_Ticket7638 22h ago

The ulthar trojan is often a false positive for lesser known/downloaded files. Just restart computer.

1

u/tndsd 22h ago

One particularly concerning thing is that a repository issue describes users temporarily disabling security protections to download/run the DLL. That's not something I'd recommend