TrainworX installers are compressed (packed) during installation to bring the file size down. Several antivirus programs, including Windows Defender (as of January 2019) incorrectly flag these installation files as a virus (normally marking them as TrojanWin32/CryptInject.E). This is because the antivirus cannot ‘unpack’ the installation files, so it just assumes they are a threat.

It is important to understand that there are no executable files in a Train Simulator add-on. All it contains is the data for the train or wagon (textures, geometry and the simulation files), so there is nothing in the installation that could be considered malicious. It is purely the antivirus software’s inability to unpack the file that causes these messages.

All TrainworX installers are clean. All add-ons are checked by VirusTotal against 60 or more different antivirus engines.

At this time there is no permanent solution to the issue. All installers have been sent to the different antivirus companies, including Microsoft, in an attempt to get them on to the ‘white list’ but TrainworX has no control over the time it will take for this to happen (if it ever happens).

For the time being, the only workaround is to temporarily disable your antivirus software during installation (and possibly also during download) if you see the Trojan false positive message.