VirusTotal was flagging motioncab.dll as a trojan. MotionCab hadn’t changed what
it did, and it was never dangerous. What changed was that I finally sat down, dug
into why so many scanners were getting spooked, and cleaned things up.
I want to walk through what was happening, why false positives like this occur, and what I did to address them.
Why antivirus tools get twitchy about MotionCab
To draw that in-game settings overlay and pick up your mouse input while it's open, MotionCab has to reach into the game's process and hook into how it renders frames and reads input. It also pings the internet to check for updates.
None of that is weird for MotionCab specifically. The issue is that this combination — hooking into a running game, drawing something on top of it, and talking to a server — is also exactly how cheats and game trainers behave. Antivirus software can't see intent, only patterns, and MotionCab's pattern happened to look a lot like something it's been trained to distrust.
Making matters worse, the file itself wasn't doing itself any favors. It was being built in a way that left a bunch of internal technical scaffolding sitting right there in the DLL, visible to anyone scanning it. Kind of like leaving your notes taped to the outside of a package — nothing secret, but it gave scanners a lot of extra material to squint at and go "yeah, this smells like a hacking tool."
What I actually fixed
For v0.4.2 and above, I changed the build process so the released DLL no longer
carries all that internal scaffolding.
It’s now packaged the way finished software normally ships: just the working code, with nothing extra tagging along. The plugin is otherwise unchanged — same features, same functionality, same in-game behavior, just a cleaner file.
So, should you worry?
Antivirus software may still flag the plugin as a virus, but if it does, it’s likely to be because the DLL is unsigned. I considered signing the DLL, but for a project like this, the cost and effort don’t seem worth it.
If you ever spot something that genuinely seems off, let me know and I'll dig into it.
