[FALSE POSITIVE] Kaspersky warning about Trojan-Ransom.Win32.Foreign.gen in world.dll

I use ESET as well, and it shows that I16FM.dll is infected with Win64/Packed.VMProtect.IR.

I use ESET as well, and it shows that I16FM.dll is infected with Win64/Packed.VMProtect.IR.

For what it's worth, i ran World.dll and WorldGeneral.dll through the Kaspersky online virus checker. Both came up green.

Did the same on VirusTotal where resp. 5 and 4 out of 68 scanners detected them as malware (BitDefender and Kaspersky came both up green).

If you then look into details, there is not much going on beside that the files are not signed.

That's what my AV was alarmed about. What the hell ED? Sign them next time :D

I think I'll give up torrent d/l until I enlighten myself on how this process works.

i think they are changing their DRM system.

and its the new DRM that is setting off all the false positives (DRM and virus have a lot in common)

they are talking to the supplier of the DRM about all the false positives.

edit : ninja'd by bignewy

Have the same issue with Norton internet security

Same issue with Bullguard - I16FM.dll

Looks like the same thing with the latest Open Beta Patch and Bullguard.

sharing the pain..

Same here, last week it was mainly "I16FM.dll", today it's been "World.dll" first after today's update, then restoring that file, restart PC, and now it's the "F14-HeatblurCommon.dll"... :music_whistling:

Virus detected by Bitdefender after update

I updated to version 2.5.6 yesterday and was surprised to see another update today I believe it was 718GB.

After installation Bitdefender displayed this warning:

"The file E:\Program Files\Eagle Dynamics\DCS World OpenBeta\bin\World.dll is infected with Gen:Variant.Ursu.768621 and was moved to quarantine. It is recommended that you run a System Scan to make sure your system is clean"

How do I roll back this update?

Absolutely safe. The hashes of what should be downloaded come from our servers (digitally signed of course). The source of data is not important after that - if it does not match the hash it will be rejected.

Cool, thanks. Used it today with no alarms from AV