# Malware detected inside IPH (Isk Per Hour)? I don't (want to) believe it **URL:** \ **Category:** Third Party Developers\ **Created:** [December 23, 2020, 4:57pm UTC](https://forums.eveonline.com/t/malware-detected-inside-iph-isk-per-hour-i-dont-want-to-believe-it/286595 "2020-12-23T16:57:56Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![Haffsol](https://sea1.discourse-cdn.com/eveonline/user_avatar/forums.eveonline.com/haffsol/32/395545_2.png) [@Haffsol](https://forums.eveonline.com/u/Haffsol)\ **Post date:** [December 23, 2020, 4:57pm UTC](https://forums.eveonline.com/t/malware-detected-inside-iph-isk-per-hour-i-dont-want-to-believe-it/286595/1 "2020-12-23T16:57:56Z")
I’ve been using IPH for a longer time than I’d like to admit, and I’ve been in contact with Zifrian here on the forum and on git and mail too. He’s a cool and dedicated guy and he’s been working really hard to keep his tool updated after all the oh so many dramatic changes CCP threw at third parties developers, so I have no reason to doubt about his behavior. Still, today I decided it was time for me to stick my nose back again into EVE and windows defender got all triggered and alarmed. ![image_2020-12-23_175554](https://global.discourse-cdn.com/eveonline/original/3X/4/6/46321799e77beebce03a14a1b8a0ddf6742dc901.png) It won’t let me complete the install because it found a certain ‘cryptinject.ml’ malware inside the executable. I googled it, I’ve seen it seems to be a ‘true’ malware, I looked quickly here and found no reference to this problem, and I opened this thread. Hope it all turns out to be a windows issue, or my own as well, but I just wanted to have it clarified once and for all. Thanks. ---
**Author:** ![Haffsol](https://sea1.discourse-cdn.com/eveonline/user_avatar/forums.eveonline.com/haffsol/32/395545_2.png) [@Haffsol](https://forums.eveonline.com/u/Haffsol)\ **Post date:** [December 23, 2020, 5:38pm UTC](https://forums.eveonline.com/t/malware-detected-inside-iph-isk-per-hour-i-dont-want-to-believe-it/286595/2 "2020-12-23T17:38:40Z")
Just for the sake of it, I downloaded the installer from the git repos, cloning the latest stable version on my desktop and extracting the installer. Anyway… although the install did not complete, I noticed that in the usual folder where all the personal data are stored ( %user%/AppData/Roaming/EVE IPH) there was the EVEIPH Updater. I launched it, it did find some updates, it downloaded them, installed them flawlessly and now I’m using IPH like a boss. I still have no idea about what triggered the windows protection antimalware thingy in the first place. ---
**Author:** ![Mkikaden\_Tiragen](https://sea1.discourse-cdn.com/eveonline/user_avatar/forums.eveonline.com/mkikaden_tiragen/32/243913_2.png) [@Mkikaden\_Tiragen](https://forums.eveonline.com/u/Mkikaden_Tiragen)\ **Post date:** [December 23, 2020, 5:53pm UTC](https://forums.eveonline.com/t/malware-detected-inside-iph-isk-per-hour-i-dont-want-to-believe-it/286595/3 "2020-12-23T17:53:27Z")
Usually this happens when something new exists that Microsoft or whatever antivirus/antimalware service hasn’t properly and thoroughly indexed as safe (yet). Even EVE throws these errors sometimes. [WINE detected as Malware](https://forums.eveonline.com/t/wine-detected-as-malware/213755) [Malware detected](https://forums.eveonline.com/t/malware-detected/98327) [False virus warning from the update?](https://forums.eveonline.com/t/false-virus-warning-from-the-update/276840) [Possible virus/malware in Wine components of Eve for mac](https://forums.eveonline.com/t/possible-virus-malware-in-wine-components-of-eve-for-mac/197462) ---
**Author:** ![Zifrian](https://sea1.discourse-cdn.com/eveonline/user_avatar/forums.eveonline.com/zifrian/32/514769_2.png) [@Zifrian](https://forums.eveonline.com/u/Zifrian)\ **Post date:** [January 20, 2021, 8:16pm UTC](https://forums.eveonline.com/t/malware-detected-inside-iph-isk-per-hour-i-dont-want-to-believe-it/286595/4 "2021-01-20T20:16:48Z")
Just saw this message but others brought this too my attention as well. I submitted the program for scanning with Windows Defender and they removed it from the definitions for CryptInject as a false positive. I also submitted one for CoinMiner but it only shows it as a potentially unwanted application (PUA) program so not sure if that will get updated. I think this started after I implemented the new log-in process where you don’t need to create a developer account. In any case, email me any issues at [eveiskperhour@gmail.com](mailto:eveiskperhour@gmail.com) or say something on Discord and I’ll check into it. ---
**Author:** ![Yberta\_Molk](https://sea1.discourse-cdn.com/eveonline/user_avatar/forums.eveonline.com/yberta_molk/32/273039_2.png) [@Yberta\_Molk](https://forums.eveonline.com/u/Yberta_Molk)\ **Post date:** [January 22, 2021, 12:31pm UTC](https://forums.eveonline.com/t/malware-detected-inside-iph-isk-per-hour-i-dont-want-to-believe-it/286595/5 "2021-01-22T12:31:15Z")
> [@Zifrian](#): > > the new log-in process where you don’t need to create a developer account. Oh ok, this put me off previously. So I only need my account details? What about steam accounts? Cheers ---
**Author:** ![Zifrian](https://sea1.discourse-cdn.com/eveonline/user_avatar/forums.eveonline.com/zifrian/32/514769_2.png) [@Zifrian](https://forums.eveonline.com/u/Zifrian)\ **Post date:** [January 24, 2021, 2:53pm UTC](https://forums.eveonline.com/t/malware-detected-inside-iph-isk-per-hour-i-dont-want-to-believe-it/286595/6 "2021-01-24T14:53:06Z")
I’m not sure but I assume it’s fine. I assume there is no special way to log into the forums with a steam account and it’s the same process. Give it a go and let me know? 🙂 ---
**Author:** ![Sofia\_Joringer](https://sea1.discourse-cdn.com/eveonline/user_avatar/forums.eveonline.com/sofia_joringer/32/321765_2.png) [@Sofia\_Joringer](https://forums.eveonline.com/u/Sofia_Joringer)\ **Post date:** [February 11, 2021, 6:44am UTC](https://forums.eveonline.com/t/malware-detected-inside-iph-isk-per-hour-i-dont-want-to-believe-it/286595/7 "2021-02-11T06:44:29Z")
Just letting you know this still seems to be a problem. I made sure Windows Defender was up-to-date, but there seems to still be a problem. It did detect it as a different malware than what’s listed above though, so… progress? I was able to tell Defender to allow it, which I had to do again after EVE ISK updated, and it seems to be working now. You might want to bug MS about it though, as they seem to have dropped the ball on their end. ---
**Author:** ![Zifrian](https://sea1.discourse-cdn.com/eveonline/user_avatar/forums.eveonline.com/zifrian/32/514769_2.png) [@Zifrian](https://forums.eveonline.com/u/Zifrian)\ **Post date:** [February 12, 2021, 12:19am UTC](https://forums.eveonline.com/t/malware-detected-inside-iph-isk-per-hour-i-dont-want-to-believe-it/286595/8 "2021-02-12T00:19:00Z")
Yeah, getting reports still. What virus or malware did it flag? A new name has come up recently. ---
**Author:** ![Zifrian](https://sea1.discourse-cdn.com/eveonline/user_avatar/forums.eveonline.com/zifrian/32/514769_2.png) [@Zifrian](https://forums.eveonline.com/u/Zifrian)\ **Post date:** [February 13, 2021, 9:54pm UTC](https://forums.eveonline.com/t/malware-detected-inside-iph-isk-per-hour-i-dont-want-to-believe-it/286595/9 "2021-02-13T21:54:45Z")
Btw, the only virus scanner flagging it is Microsoft Defender: [https://www.virustotal.com/gui/file/a1797c477240f839e1fc37894cd8a0ad29291637fc4aa297edaaeafd8624500d/detection](https://www.virustotal.com/gui/file/a1797c477240f839e1fc37894cd8a0ad29291637fc4aa297edaaeafd8624500d/detection) ---
**Author:** ![Miasnik](https://sea1.discourse-cdn.com/eveonline/user_avatar/forums.eveonline.com/miasnik/32/256682_2.png) [@Miasnik](https://forums.eveonline.com/u/Miasnik)\ **Post date:** [February 14, 2021, 9:27pm UTC](https://forums.eveonline.com/t/malware-detected-inside-iph-isk-per-hour-i-dont-want-to-believe-it/286595/10 "2021-02-14T21:27:36Z")
What is CoinMiner? I would imagine that Windows Defender is flagging it as a bitcoin/crypto miner. ---
**Author:** ![Po\_Laris](https://sea1.discourse-cdn.com/eveonline/user_avatar/forums.eveonline.com/po_laris/32/390730_2.png) [@Po\_Laris](https://forums.eveonline.com/u/Po_Laris)\ **Post date:** [April 21, 2021, 6:35pm UTC](https://forums.eveonline.com/t/malware-detected-inside-iph-isk-per-hour-i-dont-want-to-believe-it/286595/11 "2021-04-21T18:35:59Z")
Still got the message, that there is a PUA:Win32/CoinMiner inside the updater. Uploaded the installer to virustotal, result is good (negativ), but this is a huge flaw in my opinion, which needs to get adressed. ☹ the reputation of this great 3rd party tool will fall, which is the opposite of which you deserve, Zifrian ---
**Author:** ![Po\_Laris](https://sea1.discourse-cdn.com/eveonline/user_avatar/forums.eveonline.com/po_laris/32/390730_2.png) [@Po\_Laris](https://forums.eveonline.com/u/Po_Laris)\ **Post date:** [April 21, 2021, 6:41pm UTC](https://forums.eveonline.com/t/malware-detected-inside-iph-isk-per-hour-i-dont-want-to-believe-it/286595/12 "2021-04-21T18:41:58Z")
Ok, found the advisory on your discord, sorry for re-activation of this old thread. mea culpa 🙂 ---
**Author:** ![system](https://global.discourse-cdn.com/eveonline/original/3X/4/1/41ec4921cbaca7a6f9ea556e7cc20018461eae5e.png) [@system](https://forums.eveonline.com/u/system)\ **Post date:** [July 20, 2021, 6:42pm UTC](https://forums.eveonline.com/t/malware-detected-inside-iph-isk-per-hour-i-dont-want-to-believe-it/286595/13 "2021-07-20T18:42:16Z")
This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.