Latest Update for Arma 3 contains a Trojan

[Smudge]

Just had steam updating the latest version, when my Anti Virus detected a Tojan in it called " Gen:Trojan.Heur2.LPT@JZ@b8j4CDtab ". It won't complete the update or run Arma 3. It says missing file privileges. My Anti Virus has Quarantined this file.

Is this file supposed to be there or not?

[Absinthium Sage]

I'm getting the same error, and I'm using Bitdefender.
BEService.exe is infected with Gen:Trojan.Heur2.LPT@JZ@b8j4CDtab

[Smudge]

Yes I have Bitdefender too. I'm not allowing it until someone says something about this file.

[󠁳⁧nt]

Wait, the path is directly connected to the BattlEye Service, surely is a false positive

[Smudge]

Which means what exactly?

[ybar]

Yes - me too....Update bloked !

[Aco]

Its an older issue that happens when a software is trying to access certain portions of the kernal that is usually not needed for most programs, but BE works this way, and we trust BE so that they can. Its the price you pay to play on multiplayer to prevent cheating. Its not a virus. It needs those lower level access to police all of us who do not cheat. In the software world of big brother, its quite common.

TLDR: Its correct that it is behaving like a virus, but it is also needed for BE to work correctly, they call it a false positive. I call it the world in 1984.

[󠁳⁧nt]

I once had my antivirus raging because of a new driver update that supposedly had a trojan, apparently it was a false positive and their forum was full of people that had the same problem, they double checked and it was a false positive. These things happen, stay tuned on any info and send out a support request to Bitdefender.

[Smudge]

So how come it's the first time my AV has detected this. I've never come across this with any other updates to ArmA 3. Are there any solutions around it or not?

[Gяєєи мaиaLїѕнї]

I had the same issue with Transmission: Element 120 a while back. Tried to find the thread, but couldn't. It was a false positive and apparently Bitdefender, which i have, is one of the last AV programs to allow these files. The Devs communicated this to Bitdefender, from what i remember and it took Bitdefender about 2 months to allow this type of file through. If someone finds the Transmission: Element 120 thread, there was alot more in that one.

here are some threads for the heur trojan.
https://steamcommunity.com/discussions/forum/search/?q=Gen%3ATrojan.Heur2.

[Smudge]

I'm assuming it's a false positive then?

[Absinthium Sage]

There are cases when Bitdefender mistakenly flags a legitimate file as being a threat (a false positive). To correct this error, add the file to the Bitdefender Exclusions area:

Turn off the Bitdefender real-time antivirus protection:

Open the Bitdefender window.

Click Protection on the left-side menu.

Click Setting in the Antivirus area.

Turn off on-access scanning by toggling the Bitdefender Shield switch off in the window
for 5 or more minutes .

Restore the file from the Quarantine area:

Open the Bitdefender window.

Click the Notifications button on the left-side menu.

Click the Warning tab in the window.

Select the file that was quarantined and click Restore.

Resume Download of Arma III

Add the file\folder to the Exceptions list.

To add the file or folder to the Exceptions list, follow these steps:

Click the Protection button on the left side menu.

Click Setting in the Antivirus area.

Click the Exceptions tab in the window.

Click the Add button in the window below the Exceptions tab.

Check Both

Click Browse, select the folder or file that you want to be excluded from scanning and then click OK.

The default path is C\Program Files (x86)\Steam\steamapps\common\Arma 3\BattlEye

Change the drive letter or path to where your install is located if required.

Click Add and then click OK to save the changes and close the window.



This worked for me. Hope this helps.

[Sams]

Yeah, most likely a false positive. Bitdefender and few other AVs are known to have way too aggressive heuristic detection. Also it would be quite impossible to get a virus through Steam's AVs.
You could check your file with VirusTotal to get a second opinion just in case.

[Madde [me]]

Uploaded the file on virustotal.com. 12 / 70 engines detect a threat. Mostly the above mentioned Gen:Trojan.Heur2.LPT@JZ@b8j4CDtab

[󠁳⁧nt]

Originally posted by Madde me:

Uploaded the file on virustotal.com. 12 / 70 engines detect a threat. Mostly the above mentioned Gen:Trojan.Heur2.LPT@JZ@b8j4CDtab

Thanks, can you send that in as a sample for a false positive in Bitdefender's support section?

[LieutenantCommanderData-XGP]

what do i do, instead of clicking restore i clicked delete and now it wont let me download it because of Missing file privileges and i can't restore it because i deleted it were can i locate to remove it from thye AV list of files "Bitdefender Total Security" i should of investigated if it was False

"" BEService.exe was deleted at user request. ""