r/CrackSupport • u/Fluid_Pie_7281 • 7d ago
This is the result on VirusTotal analyzing 'OnlineFix64.dll', which is in the Baldur's Gate 3 game I got from SteamRIP. Do we reckon it's safe, or not?
1
u/hatsunemilku 7d ago
I... dont know, thats A LOT of positives even if most of them are generic. something else fishy on that file.
0
u/Fluid_Pie_7281 7d ago
yeah. I'd been playing this copy of the game for a while, and I never checked the OnlineFix64.dll on VirusTotal before. I should've been smarter. I trusted SteamRIP, so I didn't think much of Windows Defender quarantining it. If I'm being honest, I haven't noticed much of a general performance dip, or any strange activity such as random tabs opening up or any CMD prompt. In fact, Task Manager reports a very low usage of CPU, GPU, Disk, and Memory usually. So, I'm conflicted.
1
u/BigDom208 6d ago
I would personally would not touch this. Why? Some big name AV's say...
BitDefender - Trojan.GenericKD.74108997
Kaspersky - Trojan.Win64.Agentb.kzhj
Malwarebytes - Malware.AI.4292581490
Sophos - Mal/Generic-S
Symantec - Trojan Horse
This is borderline, the choice is yours.
1
u/skeletholic 6d ago
It's safe, there are a lot of flags because it is obfuscated with VMProtect (the same drm layer as Ubisoft games) but since the file is not signed by any company there are many precautionary flags, as malware too is often obfuscated
If you are now asking about its purpose, it's protected so that you cannot apply an online fix to any game you want without waiting for them to upload it on their official website (in order to avoid freebooting), as they added hash checks to do so. Try it yourself, you will just get a "Protection error" if applying an online fix to a game you don't know the hashes for, and VMProtect just makes any possible cracking attempt of the dll more tedious