[FALSE POSITIVE] Kaspersky warning about Trojan-Ransom.Win32.Foreign.gen in world.dll

[BaD CrC]

From the first 2.5.6 update, my antivirus software's (Bit Defender) log is turning into a Christmas tree with warnings at every patch (well the last two ones). This never happened before. Several dll or exe were blocked, either to be written or move into the game directory, halting the update process. Yesterday, the only way I found to finish the update was too completely remove the antivirus (suspending it didn't work) then re installing it after the update.

This is not something I felt good about. I ran a full scan afterwards and Bit Defender found nothing but this is still disturbing and I am wondering how much scanning and checking ED is performing on their files before releasing an update? It's kinda easy to catch and spread a virus these days.

[v2tec]

Latest Update: Kaspersky warning about Trojan-Ransom.Win32.Foreign.gen in world.dll

 

After the latest update (dcs hotfix), kaspersky recognized the Trojan-Ransom.Win32.Foreign.gen inside the world.dll.

 

 

Anybody else got this warning?

[Mars Exulte]

Yes, dozens of people as you can easily find around here. Turn off your AV when playing DCS. Write to the AV telling them to whitelist it. Problem solved

[Ayabe]

Yes, dozens of people as you can easily find around here. Turn off your AV when playing DCS. Write to the AV telling them to whitelist it. Problem solved

 

 

 

 

Uhh no, this is on ED to not be sending this sort of stuff out in the first place, it's not on the consumer to explain to AV companies why ED is sending out bad EXE's that exhibit the same behavoir as trojans.

[v2tec]

Yes, dozens of people as you can easily find around here. Turn off your AV when playing DCS. Write to the AV telling them to whitelist it. Problem solved

 

 

Absolutely not - I don't know the software and what it contains. Why should I trust it and put it on a whitelist, if an AV systems detects something wrong. That's the way trojans can easily spread.

[Leviathan667]

Same here with bitdefender

[MegOhm_SD]

Yes, dozens of people as you can easily find around here. Turn off your AV when playing DCS. Write to the AV telling them to whitelist it. Problem solved

 

Kaspersky must have a translation issue lol

 

Norton flagged a DCS .exe for me. Excluding it quickly solved the issue.

You really think ED is sliding in Trojans? :doh:

[FlyString]

Nothing here reported by Comodo Internet Security! It might be very well a false positive.

[fitness88]

Nothing from windows defender...

[maxTRX]

How safe is torrent download? I haven't had issues so far, just curious. I'm slightly behind the curve on these matters:noexpression:

I'm not too concerned about my flt sim rig but it would be a pisser if I had to zero the drives and re-install everything in case someone "discovers" something:smilewink:

[BaD CrC]

Also Worldgeneral.dll is found infected with Gen:Suspicious.Cloud4.@J8@aSO4W3ki and sent to quarantine by bit defender. This is highly unusual for a patch and slightly worrying.

[Mesha44]

I never considered this before but if you are downloading it via a torrent you are not getting the files straight from ED but from an unknown source.

 

You could try rolling it back, check that you are good and no flags go up. Then move back to open beta (I am assuming your on beta) but make sure you cancel the bittorrent and move to the download from ED.

 

Or maybe better try running the updater from a dos prompt and see if it will redownload the offending files directly from Ed.

 

https://www.digitalcombatsimulator.com/en/support/faq/709/

[rob10]

It's always possible that something might manage to sneak by and make it into a release (I'd bet big money against it ever happening, but there is no such thing as ZERO risk). Having said that, over the years I've seen too many different games where Kapersky (and a couple of other AV's) have thrown a fit over an update for me to get concerned that a reputable company like ED missed something (especially after having so many false negatives on the recent update).

And I am in the camp that the AV's hold the responsibility here. I'm not sure it would be possible for ED to a) check every release against every possible AV or b) be on top of exactly what change in their detection algorithms that might suddenly cause DCS to flag (I doubt the AV's would even share that info or the virus makers would use that info to get around it).

[Oceandar]

IIRC there was an incident that one of dev comp got infected by a virus and unknownly slipped into the update. I'm not saying this is the same case but it could be, who knows ? I have not updated my DCS to the latest patch. But my ESET didnt give any warning to 2.5.6 that some people reported having virus/trojan.

 

I suggest upload it to virustotal.com to scan over there if you're not sure.

[Mars Exulte]

Absolutely not - I don't know the software and what it contains. Why should I trust it and put it on a whitelist, if an AV systems detects something wrong. That's the way trojans can easily spread.

 

 

What? You DO know what software it is, it's a video game you're trying to play and you are getting a false positive after a major patch. Are you so new at the internet you've never heard of such a thing? It's extremely common. This isn't some random shareware you downloaded off a sketchy site, ffs. A little common sense goes a long way @@

 

After someone else's observation, due to torrenting it is technically possible, although very unlikely, to be infected. So I will retract some of my irritation. That said, my point stands. False positives are far from unknown, especially with a lot of the crappier AVs out there.

Edited February 22, 2020 by zhukov032186

[Mars Exulte]

I never considered this before but if you are downloading it via a torrent you are not getting the files straight from ED but from an unknown source.

 

You could try rolling it back, check that you are good and no flags go up. Then move back to open beta (I am assuming your on beta) but make sure you cancel the bittorrent and move to the download from ED.

 

Or maybe better try running the updater from a dos prompt and see if it will redownload the offending files directly from Ed.

 

https://www.digitalcombatsimulator.com/en/support/faq/709/

 

Hmm, that's actually a valid point. Still seems doubtful it.s anything but a false positive, but worth considering

 

Is it affecting Steam users, too, or only Torrenters? Cause if Steam, too, then it's just a false positive and we are wasting time

Edited February 22, 2020 by zhukov032186

[BaD CrC]

There are a few threads already about people having, I hope, false positives from the same couple of dll: Trojan-Ransom.Win32.Foreign.gen inside the world.dll spotted by Kapersky and Worldgeneral.dll infected with Gen:Suspicious.Cloud4.@J8@aSO4W3ki by Bit defender.

 

Good point about the torrent. Absolutely no guaranty that the files integrity is maintained I think.

[BaD CrC]

Well, since 1999, that's the first time it happens to me with an ED patch. So having this twice since 2.5.6 is making me really nervous.

[Cskelly]

Maybe it's Bit defender? My Bit Defender has been popping up more frequently as well.

[Taslehoff]

Maybe it's Bit defender? My Bit Defender has been popping up more frequently as well.

 

And Kaspersky as well. Had to reinstall the bugger three times.

[Swordsman422]

No offence, ED, but we all know you don't have the kind of security that, say, Equifax or Amazon or Facebook or....

 

I worked for one of those on your list in one of the data production departments. Let's just say I was not shocked by the hack. It was just a matter of time.

 

I've been convinced by this thread not to update to 2.5.6 for a while...

[hornblower793]

It has happened before on updates (last was several months ago) and has been false positives which is almost certainly the case this time. All these products now scan for zero day attacks (i.e. a new attack never before seen) by looking for items showing certain types of behaviour - these are often not malicious and the AV companies then tune their databases to account for this.

 

I have had this happen with other downloads from known vendors in the past and it has always been a false positive

 

You can always submit the file to your AV provider for analysis if really not sure

 

Sent from my SM-T835 using Tapatalk

[Lange_666]

For what it's worth, i ran World.dll and WorldGeneral.dll through the Kaspersky online virus checker. Both came up green.

Did the same on VirusTotal where resp. 5 and 4 out of 68 scanners detected them as malware (BitDefender and Kaspersky came both up green).

If you then look into details, there is not much going on beside that the files are not signed.

[Oceandar]

Just updated my DCS to the latest patch and my ESET as silence as sleeping baby. I'm pretty sure its false positive.

 

Happy flying

[ophiuchus]

Well, in my case ESET is reporting that I16FM.dll is infected with Win64/Packed.VMProtect.IR. Repairing does the same even when set to download through HTTP.