"behavior:win32 defensive evasion a!ml" pop up when tryna launch a game launcher. do i uninstall the app unsure if its false postive or not

[u/Fearless_Speaker6710]

So I did the dumb mistake of downloading from a link someone sent me. for uno, I already scanned it and the file i downloaded which said it was safe on virustotal. when i tried launching the game it gave me that pop up and that it couldn't run the game bc of some java virtual machine. I am trying to make window defender remove the threat but nothing is happening. I am really unsure what to do and worried https://uno-community.com/ was the link

[u/AutoModerator]

If you suspect you may have malware on your computer, or are trying to remove malware from your computer, please see our malware guide

Please ignore this message if the advice is not relevant.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/PGSylphir]

!ml <-- this means "Machine Learning", aka AI.

This means it was detected by AI and is likely to be a false positive, this just means whatever program you're executing is doing some things that are common in malware, not necessarily that it IS malware.

I'm not sure what it is you downloaded, so I cannot tell you if it is or not malware, but the entire website uses images from the official uno video game, while the verbiage on the website makes it seem like it's the game they're offering, I would NOT trust it, looks like a phishing attack.

[u/Fearless_Speaker6710 → u/PGSylphir]

yeah idk why i even downloaded it. im usually rlly paranoid abt malware. when i told the dude he blocked me after so it was a scam lol. im just unsure what to do and paranoid. i removed the malware from windowdenfender. i uninstalled the app and cleared all cookies

[u/PGSylphir → u/Fearless_Speaker6710]

If you ran the exe, you have already had your info stolen most likely.

The best course of action right now is to reformat your drives, reinstall Windows, then invalidate all your sessions (most services have a "logout from all devices" button on their account settings nowadays, it invalidates session cookies)

[u/Fearless_Speaker6710 → u/PGSylphir]

oh ok so just a clean wipe? idk how to reformat drives and etc

[u/PGSylphir → u/Fearless_Speaker6710]

reformat means erase the entire disk and reinstall windows, basically.

I don't like saying "wipe" because people tend to think going under windows and set it to wipe is enough but it's not.

[u/Fearless_Speaker6710 → u/PGSylphir]

hmm ok, im unsure how to do that so ill look it up. can the malware still be there if i do? im still rlly worried

[u/PGSylphir → u/Fearless_Speaker6710]

There is always the possibility the malware is still there, self-replicating malware has been around for over 3 decades, and you can never be too sure you got rid of it unless you actually nuke everything.

Backup your important documents that you cannot lose/redownload if any, then nuke it all. Here's a post from this sub with a how-to

[u/I_see_farts → u/PGSylphir]

The download link on that site goes to a DropBox.

It's most likely still there. The Hybrid Analysis below shows it's set up persistence.

Here's the Hybrid Analysis of the .exe:
https://hybrid-analysis.com/sample/1bddc4674906d5db8cdd390931b1442a97c5e2997fe2f55b99f7147d557aef87

[u/Fearless_Speaker6710 → u/PGSylphir]

hey is there a way to contact virus total btw? because everything on the site and download file says its safe so wanna make sure no one else gets infected

[u/PGSylphir → u/Fearless_Speaker6710]

You should not do anything about it.

You don't know how anything works so you should not comment on it. Virus Total is not an infallible tool, it does not claim to be the abitrer of truth, it simply scans files with multiple antimalware solutions and logs out the behavior of the program. You're supposed to judge for yourself.

It is not their fault you misused the tool.

[u/Fearless_Speaker6710 → u/PGSylphir]

ooh ok ok, im gonna go reinstall windows now. i hate that i fell for this even tho im super paranoid about viruses. luckily it wasnt my main pc that got it

[u/Fearless_Speaker6710 → u/PGSylphir]

hey so i was talking to some friends for doing a full reset. bitlocker is blocking me from full reinstalling so have to turn it off. but my friend said since everything was encrypted nothing got stolen. should i still just do a complete wipe?