F14 not authorized / antivirus / false positive

[MAXsenna]

okay this is not just a windows defender issue..
 
I use bitdefender and it's putting  F14-HeatblurCommon.DLL file in quarantine over and over because it detected the following code in it :
Trojan.GenericKD.76104938
 
 

It's every "Anti-Virus" solution. The fix is the same. Exclude the core folders, path:\whatever\Eagle Dynamics, and perform a repair AFTER you have made the exclusions, which have been pointed out in hundreds of posts now these past few days.
In case you're wondering why this happen for so many users now? We don't have OpenBeta anymore, which these "errors" surfaced first, and at the time the patch was applied to Stable, the Anti-Virus companies had already whitelisted the "offending" files.

Sent from my SM-A536B using Tapatalk

[scommander2]

A question for the exception rule in Steam (not after the DCS installation):

My DCS installation is at "E:\games\Steams\steamapps\common\DCSWorld", and my Steam storage is "E:\games\Steams"

If I have my AV exception rule at "E:\games\Steams", will it be the wide open due to the temporary download file may be captured by AV?

Thanks.

[MAXsenna]

A question for the exception rule in Steam (not after the DCS installation):

My DCS installation is at "E:\games\Steams\steamapps\common\DCSWorld", and my Steam storage is "E:\games\Steams"
If I have my AV exception rule at "E:\games\Steams", will it be the wide open due to the temporary download file may be captured by AV?
Thanks.

You want to set it at Steamapps.
What do you actually mean by "wide open"?

Sent from my SM-A536B using Tapatalk

[scommander2]

9 minutes ago, MAXsenna said:

You want to set it at Steamapps.

Okay, thanks...

[zyph3r]

21 hours ago, MAXsenna said:

We're talking past each other. Steam can have multiple Steam Library folders, and you can place as many anywhere as you want. You can't choose where to place DLCs, they go with the base game. But Steam is downloading to a temporary folder before it installs it that's the D drive for some reason I can only guess to why, like I explained above. Steam will always download before it installs it in a library that's why you also need to add exclusions for this temporary folder. Again that's what you see in the warning. It literally say "download". Apologies for not being too clear about that.

Please do, and again, that's NOT what Steam does. It downloads, (and probably unpacks), to D before it installs it on C.

Best of luck! 

That fixed the problem and yes it downloads to D and then moved it to C.

Thank you for your help!

[AndyB]

Just had this issue go to windows search bar, type in virus and open, "Virus & threat protection" then, "manage settings" turn off, "Real-time protection" run the updater and install the update. Turn real time protection back on after install. Worked like a charm for me

[MAXsenna]

Just had this issue go to windows search bar, type in virus and open, "Virus & threat protection" then, "manage settings" turn off, "Real-time protection" run the updater and install the update. Turn real time protection back on after install. Worked like a charm for me

Sure, but what will happen when the computer scans and find the offending files again, IF you haven't excluded the DCS folders?

Sent from my SM-A536B using Tapatalk

[Bagpipe]

Please can someone take a look at the attached log and advise.
I have the entire DCS install directory (E:/DCS World OpenBeta) set as an excluded folder with windows defender and I also excluded the DCS saved games folder for good measure.

I ran a slow repair and it updated...something...but then the next update (because I am way behind in updates) is throwing up the same issue and defender still flags this "wacatac" file as a severe threat though when I allow it, the installation still fails.

 

It is very frustrating and my head hurts    pity me

autoupdate_log.txt

[BoomBoom]

F-14 Update/Reinstall Fix: "Can't move F14-HeatblurCommon.dll" Error (Solved)

If you're getting this error while updating or reinstalling the F-14 module:

swift

CopyEdit

Can't move C:\DCS World\_downloads\Mods/aircraft/F14/bin/F14-HeatblurCommon.dll to C:\DCS World\Mods/aircraft/F14/bin/F14-HeatblurCommon.dll: (2) The system cannot find the file specified.

...here’s the fix that worked for me after hours of frustration:

What’s Happening?

DCS Updater expects the file F14-HeatblurCommon.dll to exist in the _downloads folder.

If it’s missing or 0 bytes, it can’t move it into the main Mods folder.

But if it is 0 bytes, DCS also flags it as a “useless leftover” and tries to delete it — which causes the update to fail in a loop.

Step-by-Step Fix

Go to the folder:

makefile

CopyEdit

C:\DCS World\_downloads\Mods\aircraft\F14\bin\

If F14-HeatblurCommon.dll is missing or 0 bytes:

Create a new dummy file using Notepad:

Open Notepad

Type: Fake DLL content

Save as: F14-HeatblurCommon.dll (make sure it's not .txt)

Place it in the folder above

If DCS still sees the file as disposable:

Ignore the warning window and click "Exit", NOT "Delete"

Run a repair:

Open Command Prompt as Administrator

Run:

CopyEdit

DCS_updater.exe repair

After that, retry the reinstall of the F-14 module.

It should detect the dummy .dll, overwrite it with the real file, and install successfully.

Optional Cleanup

Once the F-14 installs correctly:

You can delete the dummy .dll file if it wasn't overwritten

Remove any leftover folders like:

makefile

CopyEdit

C:\DCS World\_downloads\Mods\aircraft\F14\bin\Mods\

Final Note

If this still doesn't work:

Delete the entire _downloads\Mods\aircraft\F14 folder

Run DCS_updater.exe repair again

Then reinstall the F-14 from Module Manager

Hope this helps someone avoid the same loop I went through.

[MAXsenna]

@Bagpipe
Hi, could you post a screenshot of your exclusions in Defender?

Sent from my SM-A536B using Tapatalk

[MAXsenna]

@BoomBoom
Have you actually excluded the DCS folders in your Anti-Virus solution?
If you have, and it still complains, you could just have deleted the _download folder and performed a full repair.
Cheers!

Sent from my SM-A536B using Tapatalk

[PhantomHans]

Rest assured it's your anti-virus that's the problem here.

The latest updates to AVG anti-virus for example have it occasionally deleting parts of Windows Defender or other anti-virus or firewall programs as viruses.

 

Mine has made it so I can't even open the Windows Defender app.

 

I had this same problem triggered by trying to fly an F-14.

 

Just exempt all DCS folders. 

[CH4Pz]

On 3/21/2025 at 9:57 PM, Czar66 said:

Oh no. Please everyone, DO NOT TURN OFF your Windows Firewall or Windows Defender. That's a bad idea.

Only do this. It is enough to never see this issue again. It is/was also standard on another simulator with some avionics modeling. Also the Windows Defender is wrongly flagging other open source projects that are checked for malware code:

1.     Make an Exclusion on the whole DCS root folder on your anti-virus, including Windows Defender.
2.     Do a repair.

Usual path for files and folder exclusion management (windows 11 in english):

1.     Search for "windows security" in the search bar
2.     Virus & Threat Protection
3.     At 'Virus & Threat Protection Settings', click on 'manage settings'
4.     Bottom of the page click on 'add or remove exclusions'
5.     Add the whole DCS root Folder.

This is it. Don't touch Windows Firewall.

 

Absolute legend, thanks for the step by step !!

On 3/21/2025 at 8:36 PM, Hiob said:

Deactivate the real time protection of defender for the time being. You can re-activater it after the update is done.
(Though I usually deactivate it everytime I use DCS, to decrease any potential performance or loading time issues)

Defender IS Antivirus, just the most integrated into windows and one of the least offensive ones. Still causes the same issues from time to time. 

Cheers man, just added the whole DCS folder then

[MAXsenna]

The latest updates to AVG anti-virus for example have it occasionally deleting parts of Windows Defender or other anti-virus or firewall programs as viruses.

So cancer has come to computers now? cancer!

[Bagpipe]

11 hours ago, MAXsenna said:

@Bagpipe
Hi, could you post a screenshot of your exclusions in Defender?

Sent from my SM-A536B using Tapatalk
 

null

[Flagrum]

Admittedly, I only skimmed over the whole thread, but it seems that the commonly agreed upon "solution" is to disable your AV to ignore the DCS folder.

Really? I mean, yes, false positives happen, but we now have many different AV products complaining about the same file. Probably because of some heuristics that consider that file to contain some "virus/trojan typical code".

I am sure HB did not implement malicious code in there. And I trust HB that they have established proper means to prevent infections on their servers. But what if the implemented code is actually a _potential_ security risk that some ill minded people _could_ exploit? Are we sure that the file is really safe? Did HB do a code review or something like that of their code to ensure that this can not happen?

What is HB's stance on this issue?

[MAXsenna]

8 minutes ago, Flagrum said:

commonly agreed upon "solution" is to disable your AV to ignore the DCS folder

Mild correction. You add exclusions to your Anti-Virus solution, you don't disable your Anti-Virus solution. 

8 minutes ago, Flagrum said:

but we now have many different AV products complaining about the same file.

Many of them uses the same database, works the same. That's why. And this is not new.

10 minutes ago, Flagrum said:

But what if the implemented code is actually a _potential_ security risk that some ill minded people _could_ exploit?

Not how it works.

11 minutes ago, Flagrum said:

Are we sure that the file is really safe?

Yes! 100% The file will be whitelisted in a couple of weeks, even if someone claims it already is in Defender.

12 minutes ago, Flagrum said:

Did HB do a code review or something like that of their code to ensure that this can not happen?

Again, not how it works. It's not even HB. It's the encryption Eagle Dynamics uses that triggers the AV, not the code in any of the files.

13 minutes ago, Flagrum said:

What is HB's stance on this issue?

How many times do you expect them to answer? Or should we answer for them? Or, you could scroll up and read for yourself.  

I take it you never used OpenBeta? 

[MAXsenna]

2 hours ago, Bagpipe said:

null

Thanks! Did you try to reboot after you made the exclusions? I've seen reports that the exclusions in Defender might not kick in until a reboot. 

Checked the update log. Can you check if the file is in the _download folder, and if it may have a size of 0 Bytes? If yes, try to delete it and repair/update again. 

[Czar66]

14 hours ago, Bagpipe said:

Please can someone take a look at the attached log and advise.
I have the entire DCS install directory (E:/DCS World OpenBeta) set as an excluded folder with windows defender and I also excluded the DCS saved games folder for good measure.

I ran a slow repair and it updated...something...but then the next update (because I am way behind in updates) is throwing up the same issue and defender still flags this "wacatac" file as a severe threat though when I allow it, the installation still fails.

 

It is very frustrating and my head hurts    pity me

autoupdate_log.txt 294.39 kB · 9 downloads

Hi Bagpipe. It seems that your installation is missing the F14-HeatblurCommon.dll that may have been deleted by the anti virus. Try to remove/uninstall the module through the launcher, do a repair and then update DCS.

If the issue persists. Try the following:

1. Disable real-time protection temporarily on windows defender despite having the DCS root folder in the exclusion list. Type: "Windows Security" in the Search Bar -> Virus & Threat Protection -> Virus & threat protection settings 'manage settings' -> Turn off real-time protection.
2. Restart PC.
3. Do a DCS repair and whatever else DCS needs including re installing the F-14 module.
4. Re activate real-time protection from windows defender.

 

10 hours ago, PhantomHans said:

The latest updates to AVG anti-virus for example have it occasionally deleting parts of Windows Defender or other anti-virus or firewall programs as viruses.

So, they are attacking eachother now. Wild!

I'm not surprised, though... sad.

[Flagrum]

40 minutes ago, MAXsenna said:

Mild correction. You add exclusions to your Anti-Virus solution, you don't disable your Anti-Virus solution.

Yes, sorry, I mistyped. Meant to say "disable scanning the directory".

.... ah, never mind the rest ...

40 minutes ago, MAXsenna said:

How many times do you expect them to answer? Or should we answer for them? Or, you could scroll up and read for yourself.

I take it you never used OpenBeta?

I said that I only skimmed this 11+ pages long thread. My fault, I know. But next time I will spend an hour or two to not bother you anymore.....

Yeah, I just started with DCS last week ..................

 

[MAXsenna]

I said that I only skimmed this 11+ pages long thread. My fault, I know. But next time I will spend an hour or two to not bother you anymore.....
Yeah, I just started with DCS last week ..................
 

You don't bother me!
So salty! I know you've been playing DCS longer than I. Reason I asked about OpenBeta was regarding all the people now posting about the false positives we didn't get before. Was really an honest innocent question.

Sent from my SM-A536B using Tapatalk

[Flagrum]

2 hours ago, MAXsenna said:

You don't bother me!
So salty! I know you've been playing DCS longer than I. Reason I asked about OpenBeta was regarding all the people now posting about the false positives we didn't get before. Was really an honest innocent question.

Sent from my SM-A536B using Tapatalk
 

Yes, most cases of false positives were solved during Open Beta which users of the Release version probably never saw. But it is less about the number of users reporting this problem right now - imo more interesting (and being different from the past, iirc) is the range of different AV products complaining about the same file.

[MAXsenna]

Yes, most cases of false positives were solved during Open Beta which users of the Release version probably never saw. But it is less about the number of users reporting this problem right now - imo more interesting (and being different from the past, iirc) is the range of different AV products complaining about the same file.

I guess most OpenBeta users already had the inclusions in place, or were using Defender.

Sent from my SM-A536B using Tapatalk

[Bagpipe]

4 hours ago, Czar66 said:

Hi Bagpipe. It seems that your installation is missing the F14-HeatblurCommon.dll that may have been deleted by the anti virus. Try to remove/uninstall the module through the launcher, do a repair and then update DCS.

If the issue persists. Try the following:

1. Disable real-time protection temporarily on windows defender despite having the DCS root folder in the exclusion list. Type: "Windows Security" in the Search Bar -> Virus & Threat Protection -> Virus & threat protection settings 'manage settings' -> Turn off real-time protection.
2. Restart PC.
3. Do a DCS repair and whatever else DCS needs including re installing the F-14 module.
4. Re activate real-time protection from windows defender.

 

So, they are attacking eachother now. Wild!

I'm not surprised, though... sad.

Hi,

 

I have already tried all of the slow repair and rebooting and what not several times.
The update goes fine until this file attempts to install and then, somehow, defender flags it even though the DCS folder is clearly excluded.
Should I try excluding the dcs updater utility folder too?

It doesn't make sense to me to have to but at this point I am trying anything

[Czar66]

5 hours ago, Bagpipe said:

Hi,

 

I have already tried all of the slow repair and rebooting and what not several times.
The update goes fine until this file attempts to install and then, somehow, defender flags it even though the DCS folder is clearly excluded.
Should I try excluding the dcs updater utility folder too?

It doesn't make sense to me to have to but at this point I am trying anything

Did you take any action on the 'threat'? Seems like the file is in quarantine. Either nuke that file with windows defender and restart or make windows defender bypass it clicking to allow it to exist.

Your windows defender panel shouldn't display any 'current threat' existing, before making a repair or updating DCS.

Last resort:

1. Download the DCS installer from the DCS website.
2. Make it install DCS on the same drive but in a different folder. You can name it whatever you like.
3. Stop installation when it is downloading the files.
4. Make an exclusion on Windows Defender and in any other anti virus you have, of that new folder.
5. CUT and paste your old DCS files to the new folder made. If any file is stuck by 'another program is using this file', Let them be and bypass them. The goal is to avoid downloading massive files again.
6. Resume installation through the installer you just downloaded for the path of that new folder you've made. It will verify the files that exists instead of re downloading everything.

Edited March 23 by Czar66