[FALSE POSITIVE] Kaspersky warning about Trojan-Ransom.Win32.Foreign.gen in world.dll

[ophiuchus]

I use ESET as well, and it shows that I16FM.dll is infected with Win64/Packed.VMProtect.IR.

[Oceandar]

I use ESET as well, and it shows that I16FM.dll is infected with Win64/Packed.VMProtect.IR.

Hmm... thats weird. I'm using ESET Internet Security. Always with the latest update.

[maxTRX]

For what it's worth, i ran World.dll and WorldGeneral.dll through the Kaspersky online virus checker. Both came up green.

Did the same on VirusTotal where resp. 5 and 4 out of 68 scanners detected them as malware (BitDefender and Kaspersky came both up green).

If you then look into details, there is not much going on beside that the files are not signed.

 

That's what my AV was alarmed about. What the hell ED? Sign them next time :D

 

I think I'll give up torrent d/l until I enlighten myself on how this process works.

Edited February 22, 2020 by Gripes323

[BIGNEWY]

This is a false positive, if you are happy please add DCS to your whitelist or wait for your antivirus definitions to update.

 

thanks

[Quadg]

i think they are changing their DRM system.

 

and its the new DRM that is setting off all the false positives (DRM and virus have a lot in common)

 

they are talking to the supplier of the DRM about all the false positives.

 

edit : ninja'd by bignewy

[Spearzone]

Have the same issue with Norton internet security

[Gannet]

Same issue with Bullguard - I16FM.dll

[Branston]

Looks like the same thing with the latest Open Beta Patch and Bullguard.

[Wiesel02]

sharing the pain..

 

Same here, last week it was mainly "I16FM.dll", today it's been "World.dll" first after today's update, then restoring that file, restart PC, and now it's the "F14-HeatblurCommon.dll"... :music_whistling:

[c0ff]

How safe is torrent download?

 

Absolutely safe. The hashes of what should be downloaded come from our servers (digitally signed of course). The source of data is not important after that - if it does not match the hash it will be rejected.

[fasteddie1]

Virus detected by Bitdefender after update

 

I updated to version 2.5.6 yesterday and was surprised to see another update today I believe it was 718GB.

 

After installation Bitdefender displayed this warning:

"The file E:\Program Files\Eagle Dynamics\DCS World OpenBeta\bin\World.dll is infected with Gen:Variant.Ursu.768621 and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean"

 

How do I roll back this update?

[maxTRX]

Absolutely safe. The hashes of what should be downloaded come from our servers (digitally signed of course). The source of data is not important after that - if it does not match the hash it will be rejected.

 

Cool, thanks. Used it today with no alarms from AV