Fakes about TLauncher virus checks
There are various strange instructions for checking viruses in TLauncher... They say our program has viruses, which you may find and thereby confirm the theories of bloggers. However, these instructions are a pure manipulation and substitution of facts, which we will talk about in this article.
Other articles about exposing fakes:
TLauncher has no SpyWare! [Details]
Are there viruses in TLauncher? Details!
Content:
- Brief description and conclusion
- What is a digital signature?
- The working principle of anonymous Reddit users
- Using instructions from Reddit to check other programs
- Checking Avast Antivirus Installer File
- If you remove the digital signature from any file, will the scanner detect viruses?
- I was told that you have hidden files. Is that true?
Brief description and conclusion
Anonymous Reddit users remove digital signatures from our files and upload them to virustotal, which detects viruses. This is a pure manipulation since if you remove the digital signature from any other trusted programs (Avast, Microsoft, Malwarebytes, etc.), virustotal will also mark them as infected (original versions with digital signatures are free of viruses). In short, antivirus scanners may consider this a file substitution or a false positive. It’s not proof but an attempt to slander us!
What is a digital signature?
Each file can be signed with a special signature, which guarantees that the file is received from a specific publisher (website) and has never been modified. The absence of a digital signature on a file means that the file has been modified and is not safe to use. We sign all TLauncher files with a digital signature!
The working principle of anonymous Reddit users
If you remove the digital signature from our files and upload them to virustotal.com, some antivirus scanners will mark our files as infected…
The part where they suggest removing the digital signature from our files.
They seem to have found some kind of “evidence” of viruses, albeit in a strange way. However, it is a pure manipulation – if you remove the digital signature from other popular programs (as an example), they will also be marked as malware on virustotal!
Using instructions from Reddit to check other programs
We are going to show you other programs with a removed digital signature. According to the instructions from Reddit, they will also have “viruses” on virustotal.com.
Checking Avast Antivirus Installer File
Avast official website for download: https://www.avast.com/index#pc
Link to virustotal file With digital signature (tab "Details" -> "Signature verification"): https://www.virustotal.com/gui/file/05d2dd4435b9e77d21cd661102d764a9aa48611e4906233ba8b32a1308297f6d/detection
As you can see, the file is safe according to all antivirus scanners. Let’s move on to the next step – we need to remove the digital signature from the file. Later, there will be a guide on how to repeat it. But for now, leave it to us. Run CMD.exe and run the command:
"C:\Program Files (x86)\Windows Kits\bin.0.19041.0\x64\signtool.exe" remove /S D:\test\avast_free_antivirus_setup_online.exe
The digital signature has been successfully removed. After that, let’s upload this file to virustotal.com and check it with antivirus scanners. The result is no surprise at all. The thing is that the Avast file without a digital signature has the following result: 10 viruses detected…
Link to virustotal file WITHOUT a digital signature: https://www.virustotal.com/gui/file/567a7bf4546a346107405ef933ed0a0c3c66854af5ca9f91668f22f04a142a2a/detection
We attach a video of checking Avast (without editing):
But probably that’s not enough and we need at least 4 more examples to test the theory.
Let’s check another program that you trust even more, for example, Windows 10 Update Installer File from Microsoft.
Official download site: https://www.microsoft.com/en-us/software-download/windows10 (Update Now button)
Link to virustotal file With digital signature: https://www.virustotal.com/gui/file/c0424d0ae06ca1e6e0249b40d33ac40d74075856d543ec0924884664fba52b79/detection
The file is clean! Let’s run CMD.exe and remove the digital signature:
"C:\Program Files (x86)\Windows Kits\bin.0.19041.0\x64\signtool.exe" remove /S D:\test\Windows10Upgrade9252.exe
After successfully removing the digital signature, you can upload the file to virustotal:
Link to virustotal file WITHOUT a digital signature: https://www.virustotal.com/gui/file/0e210661656514fabb3953e95591fdd367426419ab634eca545e080d7c0a0c36/detection
We get the well-known result with viruses... This time, 11 antivirus scanners find the file without a digital signature not safe.
Now let’s try to check out Malwarebytes, which is a popular antivirus, including among our users.
Official download site: https://malwarebytes.com/
Link to virustotal file With digital signature: https://www.virustotal.com/gui/file/d3e21e607c9b4e4c1d9cc08d38aca37b91544fbfd5a9b7aca3485215ef41fbef/detection
The file has no antivirus detections. Run CMD.exe and remove the digital signature:
"C:\Program Files (x86)\Windows Kits\bin.0.19041.0\x64\signtool.exe" remove /S D:\test\MBSetup.exe
After that, we upload this file to virustotal:
Link to virustotal file WITHOUT a digital signature: https://www.virustotal.com/gui/file/cff8f3cefb8b7f17e709aedd094d7bf84223b9290cfb3baedfe1fa1a21adcfc6/detection
Without a digital signature, the file has numerous tags from antivirus scanners.
But let’s move away from antivirus software and Microsoft. Let’s take something completely different. For example, let’s check AnyDesk, which is a popular remote access program.
Official download site: https://anydesk.com/en/downloads/windows
Link to virustotal file With digital signature: https://www.virustotal.com/gui/file/580f6a285c6c3b7238bd16e1aeb62a077ae44b5061a2162e9fd6383af59028bb/detection
The file has no antivirus detections. Run CMD.exe and remove the digital signature:
"C:\Program Files (x86)\Windows Kits\bin.0.19041.0\x64\signtool.exe" remove /S D:\test\AnyDesk.exe
As always, we upload the file to virustotal and wait for the results:
Link to virustotal file WITHOUT a digital signature: https://www.virustotal.com/gui/file/ef22fea0fb31e395e128e18cd33b02452b2c65e794b7292047f6e8881ba6b4e4/detection
This program gives some incredible results! 0 virus detected with a digital signature and 15 without it... Shock content!
Finally, let’s check Discord, which is usually used by all these bloggers.
Official download site: https://discord.com/download
Link to virustotal file With digital signature: https://www.virustotal.com/gui/file/7d5c479d6c4c89e8f535010e7fe8e71e02ca015045eee5ecb08b98fd18f29592/detection
The file has no antivirus detections. Run CMD.exe and remove the digital signature:
"C:\Program Files (x86)\Windows Kits\bin.0.19041.0\x64\signtool.exe" remove /S D:\test\DiscordSetup.exe
After uploading the file to virustotal, we see the following results:
Link to virustotal file WITHOUT a digital signature: https://www.virustotal.com/gui/file/b6103e93b8b4d04c38f268c6e306a72d101395f7442bd20cb612a382c5fab180/detection
Why do these bloggers use Discord if it has viruses? We have checked it using their method and the scanner also detects viruses. This means the program is not safe... This should be the logic of those bloggers from Reddit.
Detailed results
As you can see, any trusted program without a digital signature can be identified as virus-infected. This is how the antivirus protection system works – you cannot remove the digital signature from files! The conclusion is simple: bloggers consider Microsoft or Avast virus-infected since they have a lot of detections... That’s nonsense!
Treat anonymous posts with caution. After all, it is not known who writes them and why. Our competitors always use fakes and order ads from bloggers to advertise their programs. These YouTube bloggers do not hesitate to advertise our competitors in the same videos where they talk about our so-called viruses. In fact, if you check these programs, they will also have viruses on virustotal! It is absolute hypocrisy to talk about viruses and in a minute advertise something that has viruses detected.
If you remove the digital signature from any file, will the scanner detect viruses?
We don’t know. Perhaps it depends on the specifics of the file and its popularity. They may check files without digital signatures and remove all detections in advance. This check is too “artificial” and does not reflect the real situation with file security. We have checked trusted companies and their files, primarily installers, just like our files being investigated.
I was told that you have hidden files. Is that true?
Files that we move to Temp, namely pictures, offers, and uninstaller, should be in a temporary directory so that they can be deleted after installation. The uninstaller must have our digital signature, so it is pre-installed in the installer. This uninstaller can help you uninstall the program at any time using standard Windows tools. All programs do that. That’s not our invention!
Offers are a browser installer and it is not necessary to install it. If you see this ad, just uncheck the box to avoid installing this offer.
Bloggers say that your files are not checked by antivirus scanners due to their digital signatures. Is that true?
The digital signature does not provide any benefits when the file is checked with antivirus scanners. Otherwise, hackers would easily spread viruses. That’s the position of any antivirus software. You can easily find digitally signed programs that have been detected as malware. Here are some of such programs and their results:
Light Alloy: https://www.virustotal.com/gui/file/f4ff16e76d3e7caae08820c11a910fcf2c9f759a3e416e8677d65df764904bef/detection
Aimp: https://www.virustotal.com/gui/file/21a1df4b36e29327694a627a54d8e47167c781db2e6bf560319be45ca4fc761f
This does not mean they have viruses, but the digital signature does not save them from false positives.
How can I check that?
1) You need to install Windows SDK: https://developer.microsoft.com/en-us/windows/downloads/windows-sdk/
2) And find the file signtool.exe in the folder C:\ProgramFiles (x86)\WindowsKits\bin.0.19041.0\x64\ (you may have a different version)
3) Open CMD.exe (find it through the Start Menu search).
4) Paste the command and execute (using your paths): "C:\ProgramFiles (x86)\WindowsKits\bin.0.19041.0\x64\signtool.exe" remove /S"D:\Windows10Upgrade9252.exe"
Where:
"C:\Program Files (x86)\Windows Kits\bin.0.19041.0\x64\signtool.exe" is the path to your signtool.exe file
"D:\Windows10Upgrade9252.exe" is the path to your file to remove the digital signature
5) After removing the signature, you can upload the file to virustotal.com
Comments