Trojan:Win32/Kepavll!rfn Virus or Windows Defender Being Sensitive?

Question

So I was downloading a modpack for Cyberpunk when one of the files which many mods relied on came up with the following message. Mod is called cybercmd and is available on Nexus mods or github. The modding community seems mixed on whether or not it is a virus so I thought I would triple check. Below are the windows security actions and total scans on both the nexus and github downloads. I would like to know if it is safe to release from quarantine and if not, what actions should I take to ensure that I am safe from malware. Let me know if you require more to troubleshoot. Thanks in advance.

Threat: Severe
Detected: Trojan:Win32/Kepavll!rfn

Status: Quarantined

Details: This program is dangerous and executes commands from an attacker.

File: D:\vortex\cyberpunk2077\cybercmd-5176-0-0-12-1701894510.zip

This is a mod from nexus mods for cyberpunk 2077.

virus total scans.

Nexus version:

https://www.virustotal.com/gui/file/330f2f2fdc0fb220e368a36d38a95f2cce549f10cdcf74065f90ea75c5767232/details

Github version: https://www.virustotal.com/gui/url/9949897499916c310a8418b7fda6aae40b98c1034aed6c9dd10acbf7af764911/details

Github version log

Threat: Severe

Detected: Trojan:Win32/Kepavll!rfn

Status: Removed

Details: This program is dangerous and executes commands from an attacker.

File: D:\vortex\cyberpunk2077\cybercmd.zip
Webfile: D:\vortex\cyberpunk2077\cybercmd.zip|about:internet|pid:15308,ProcessStart:133918555236502331

Answer 1

The Nexus version: link shows a couple detections as a "Hacktool".

"HackTool" and "RiskTool" detections do not mean the file is always bad...in some cases the these detections are related to legitimate programs which can be misused by others for nefarious purposes.
 
The Github version link only shows one detection. That indicates the detection could be a false positive.
 
The consensus among most experts is that if 90%+ of the results of an online file analysis (VirusTotal, Jotti's virusscan, MetaDefender, Hybrid-Analysis, etc) indicate a file submission is clean, then you can disregard the other detection(s) as a false positive...especially if the detection is more generic, suspicious, potentially unwanted (PUPs) and/or was made by any of the lesser known security vendors. This is typically due to the security program's heuristic analysis engine which provides the ability to detect possible new variants of malware. For a more detailed explanation, see my comments in this topic (Post #18)
 
I would contact the program developer, advise them of the detection and ask what they have to say about it.

Answer 2

Hey Galen!

Thanks for reaching out here. The mod you have downloaded was Trojan:Win32/Kepavll!rfn, which is a threat to your device. This is a very can lead to virus getting to your device. Here is what you can do:

> Do not restore files from Quarantine.

> Delete it permanently.

> Run a full system scan with Windows Defender.

> Avoid using the mod until it's proven safe by the community.

Kindly get back to us for updates.

Yvette,

Answer 3

yes i have i "virus" called Trojan:Win32/Kepavll!rfn and it says its in file: C:\Windows\System32\drivers\etc\hosts

what do i do

Answer 4

Did you make any changes to your Hosts file or install any security programs which may have made changes (added or removed entries? This is an example of the Hosts file found in Windows 11 at C:\Windows\System32\drivers\etc\hosts

The contents of the hosts file looks like the example shown in What is the Hosts file in Windows.

While some types of malware can make changes to a hosts file, I know of several legitimate security programs which will deliberately make changes.

You can navigate to C:\Windows\System32\drivers\etc\hosts to view the contents. I recommend you copy and paste it to another folder, rename it by adding .txt at the end (hosts.txt) and compare it to the one shown in the above link.

How to Locate Hosts File on Windows

BTW... Microsoft Naming scheme for Trojan:Win32/Kepavll!rfn detection: 
Trojan indicates Type of malware...describes what the malware does on your computer.
Win32/ indicates Platform...compatible operating system (such as Windows, macOS, Android) for the malware.
Kepavll indicates Family...grouping of malware based on common characteristics.

!rfnindicates !Suffixes...a suffix that begins with ! is an indicator used by Microsoft internally.
 
The detection most likely was based on Microsoft Defender's use of heuristic analysis which performs a statistical analysis in order to determine the likelihood that a file contains program code that may indicate a virus A heuristic scanner does not compare code to a signature file like a virus scanner but uses a grading system to determine the probability that the program code being analyzed is a virus. Heuristic scanners do not require updating but they have a tendency to report false positives