ldntvdm.dll - please check if it is infected by a virus/malware

[emersonazul]

I followed the steps in compiling the source code and already compiled the redistributable package. I executed this on a separate environment inside my VirtualBox. However I cannot proceed with the installation of the executable program on my Actual Windows 10 -64bitSystem since some portion of the installation file is blocked by my antivirus software Kaspersky.

ldntvdm\syswow64\ldntvdm.dll
infected with UDS:DangerousObject.Multi.Generic

Is it safe to install the package? or it is just false positive detection by Kaspersky?

Thanks and Regards,
Emerson

[emendelson]

Because of the way this file modifies ordinary Windows operations, many anti-virus products will flag it as dangerous. In fact, it is not malicious in any way. But you have full access to the source code, and you can study the code and decide for yourself whether or not to use it.

[leecher1337]

ldntvdm.dll got flagged again, submitted to Microsoft as false positive, status of submission can be checked here:
https://www.microsoft.com/en-us/wdsi/submission/5faba1e1-98a6-4ece-984c-7e2308d0abbd

To avoid this problem, you can do the following:

1. Upon installation, create a folder where you unpack the installer to. Add this folder to Windows Defender whitelist before unpacking installation package.
2. Add your Windows directory to whitelist
3. Install package

Then it should install correctly and you don't get annoyed by the false positive of stupid Windows Defender.

[jlnhlfan]

Every web browser I have used detects NTVDMx64 as a virus, thus not allowing me to download it.

[leecher1337]

Disable Safe browsing in your browser, i.e. in Chrome: https://support.google.com/chrome/thread/10158080/chrome-version-75-disable-safe-browsing

This should prevent these stupid false positive malware checks.

[ulysseswhite1337]

the zip file is safe its just windows defender overreacting (note: i have used this program on my computer before and it
did nothing to it)

[gspears333]

In 2025 Windows Defender (WD) now reports ldntvdm.dll has the dread Trojan:Win32/Wacatac.B!ml.

There is a LOT of controversy as to whether this threat -- in numerous instances -- is a false positive or not. The arguments for false
positive are significant: in example coders who complain their innocuous code was flagged by WD.

I've also had my code flagged by varied AV, especially in the heuristics modes where the AV proceeds forward in a form of intelligent guessing based on the db.

I note too, that only some of the ldntvdm.dll builds get flagged, and not others. This speaks volumes to me.

So much more I could say, but this is long already. I'll leave it to the individual to decide -- I just hope you websearch significantly. As for me, I will for now disable WD during install, exclude the binary directories from WD, and such. I am also inclined to get 2nd opinions from competing AV before I personally close this issue forever, for me. You do you.

[leecher1337]

Hm, was the old build before yesterday's commit marked clean?
There wasn't any significant change in the loader's code, so maybe I should roll back the commit then, it's not so important, as it used to work with the older build too.
It's not clear what causes the detection, maybe the necessary 32->64bit Heaven's Gate code, but I once tried to XOR-Encrypt the code but that didn't help to outsmart the stupid Antivirus signature.
Seems to be the same idiocracy as Trojan.Xpack.gen with Avira. As soon as you used /OPT:NOWIN98 Linker option in Visual Studio 6 and merged sections to save space, the signature went off and flagged it. Stupid AV vendors...

[gspears333]

First, a big thank you. Running 16 bit, 1990s stuff natively in Win 10 64bit is a bit of a dream come true -- DOSbox was never quite perfect, and getting Win98 to run on new equipment has been tedious.

Hm, was the old build before yesterday's commit marked clean?

I can tell you this, the build I did late last nite (2025.04.04, 2300 central time) now does NOT get flagged by Windows Defender.

I hinted in my last post I may be getting 2nd opinions and I have, most notably at https://www.virustotal.com/gui/home/upload

This site seems competent to me and appears to run ~70 AVs after uploading via web browser. In these instances, I can always find that 1 or more of the 70 AVs will report a positive (even on the new build from last nite).

Also interesting is that the versions within the release subfolder ( ..\releases\usa\ldntvdm\syswow64... 5.1, 6.1, 6.2 ... etc) will yield different results at this site: some flagged by 1 of 70 AVs and some much higher.

My conclusion is that this is very telling: why would versions be variable in their threat, yes? Clearly, the AV findings are influenced by the compile itself (or similar nuance) rather than actual code logic, imo. I think you can appreciate this notion.

EDIT: for me, this issue is put to bed. The world will never be without false positives. That's just the way it is.

Thanks again . . .

[gspears333]

NirSoft's ProduKey is an example of a program that is perpetually flagged as malware. Apparently it touches an area that is taboo, imo. There is obviously a corporate interest in having users purchase and re-purchase software for every install. Hence, allowing users to retrieve Product Keys--and using software tools that do this--must therefore be throttled, it seems. The easy way to hit that goal? Playing on users' fear of infection, maybe?

The NirSoft guy has an excellent writeup on his multi-year dilemma here

[leecher1337]

Yeah, it's a mess.
I once wrote a totally innocent C-Program, roughly 2 pages of code, that was jsut reconnecting disconnected network drives using Standard Windows-API calls for that. That was to remedy a problem starting with Windows 7, so I put it in Autostart to reconnect the drives on startup so that they don't show up disconnected until first use.
50% (!!) of all Antivirus Scanners on virustotal flagged it as malware. I then made a test and submitted it to whitelisting to various AV-vendors and all admitted that it was harmless, but most of them - if they even cared to answer - just put it on a whitelist.
So this whole heuristics stuff is a real nightmare. It's a dilemma, AV software should be able to detect new threats where there are no signatures for, but this can only be archieved with heuristics and this results in a high false positive rate in turn.

But I agree, there are also a lot of rogue players on the market which i.e. falsely flag Keygens or cracks as malware which is completely misleading and purely intentional. Even Microsoft AV included in Windows does this. Kaspersky doesn't do that at least, so it's a good indicator on virustotal for this class of Software.