itch.io

itch has no public reviews. only that 5 star counter. you should not screenshot users and make public what they told in private. it is unprofessional. also you should not call your users idiots, as you did in your devlog.

if you suspect terms of service violation, you should report it. otherwise, as far as i know anyone can review anything and just like "unfair" 1 star reviews are not removed, "unfair" 5 star reviews are not removed either.

if this is review "bombing" (3 reviews over 5 days at the time you called those users idiots in your devlog is hardly a bombing), you can relish in the fuzzy warm feeling that the bombs actually help your game. a game with 10 reviews and a 4.9 looks not as good as game with 20 reviews and 4.0.

and as soon as there is any topic in a game that is even slightly controversial, like ai, a too good 5 star counter actually looks fishy. at least that is my opinion about the matter.

oh yeah. what if your development environment got hacked or the latest update brought an infected version to your rig. only yesterday i saw an account here that was hacked and had a normal game hosted plus another game that was malware. while developers here will get hacked as all the other users, in general, developers are also targetted by scams that specicifally target small business. even if you are hardened for the usual scams, you might fall for those small business scams, since they are new to you.

oh nice. the option to download with or without virus.

but seriuosly though, whatever those fusion thingy is doing, it trips heuristic virus detection to the moon and back. and they did not learn to recognise viruses for nothing.

the programmers probably thought how clever they were. but this is not 1990. we need not clever, we need stable. and since the zip is even smaller, what good was achieved there, except give fusion a bad name, flag an indie game and teach people to ignore warnings? 

very seriously: do not, under any circumstances just ignore warnings, because people tell you to, especially at the source of the download. real scammers will lie to your face that their malware is not malware. and people that claim that somethign is a false positive can not guaratnee this.

itch unfortunately is a cesspit of real actual malware. i saw like 20 the last few days. and i am not inflating that number.

if renpy's engine developers are reliable

they are demonstrably reliable in creating an engine again and again that flags as malicous.

but godot is not any better in that regard, it seems.

it is concerning that several renpy versions and exe files made with it raise alarms on anti virus scanners. especially since games made with that engine are often used to distribute malware. i checked some of the games in my library, from trusted developers with hundreds of followers and years of being published. i got worse postives on virustotal on those. actually i did not find a single game with no false positives. always a different "threat".

but the thing you cite is not very concerning. think about it. this is what happened in the sandbox. a file was created in a protected folder. apps cannot just write in a windows sub folder. it stands to reason that the dot net framework itself created the file. you only see that the file was created. not which process created it. also, that was a registry key, not a file.

compare a known non malware used with many games (i played at least two of those exe file names, downloaded from trusted source):

https://www.virustotal.com/gui/file/986e56c244da18a08b3f05d721ca73c481ecaf4d2db3...

it might still be malware, but the reason for your 100% confidence is 100% unsound.

search for the game name on itch. and then please report the scam version.

 itch was contacted almost a week ago. they sit on those reports or they ignore them or they do not believe them. maybe they listen to you. or others reporting the fake.

to tell the truth i did not even know the original was on itch too. but games hosted on dlsite do not appear here on itch as a free full game, just like that. when itch did not remove it from index after several work days, i wondered why the impostor did not use the correct spelling...

so i hope this is not some plot twist, and there are two impostors, since you do not link to dlsite, but the fake project does. ;-)

in case this thread does not get removed, as a caution to all reading this:

you cannot trust scanners. least of all the ones itch is using. no positive scanning result proves nothing.

please use some sort of sandbox mode to execute games from untrusted sources. being hosted on itch is not a trusted source. not even when the game links to socials of the original developer. those other socials need to link back and also need to be genuine.

so to anwer your question about proof, it is by deduction.

there are two curse of dare projects. one uses a misspelled username. one uses a repacked file. one is paid. one is free.

so there are a few possibilities what this could be.

simple piracy. but why impersonate.

scamming for donation money. retrieving the money takes time and is risky.

distributing malware.

the original developer released the game twice with different accounts.

something else.

what would you pick?

why would you install a game from an obvious impostor account in the first place. in case you mistook the link i posted for the link you are on, look again.

but i shall edit the posting to clarify.

itch is not acting against https://delusriaa.itch.io/curseofdares and having that malware impostor crap still indexed even. i suggest you tell itch in no uncertain terms what you think of their service. and maybe leave a report on that game as well. maybe their automated system will take it down if enough reports come in, since they are amateurish enough to not work on weekend, when their users are hacked the most. and yes that crapp was reported several days ago, when there was no weekend.

shame on you, itch, shame on you!

(NOTE this here is the original. the link above is the impostor. just look here https://itch.io/search?q=Curse+of+Dares it STILL shows two of them)

your page is quarantined. it might help if you link from your patreon to itch, and appeal to support with proof that you at least control the patreon, to clear things up. patreon apparantly has better user verification than itch...

unfortunately a patreon link is not proof that a game is genuine, they often do fake this exactly because of concerns like your's. on rare occasion the scammers even reply in comment.

and since the game is quarantined, some people thought the same and reported it. very good. not for this game, but that people are reporting suspicous things.