Uninstalled due to Virus Detection in Updates

[That Goth Guy]

ESET states that Flight.dll and Scripting.dll contain a variant of Win64/Packed.VMProtect.AC
This is preventing the game from updating!
I have therefore uninstalled the game!

A little research shows this happens if a file is protected with VMProtect and has an invalid digital signature so I'm sure it's something the Developers can and should fix.

[Troll Norris]

Most often it is false positive. There is not possible to detect any virus because all data are encrypted. So the antivirus software can not see what is inside because it can not decrypt those.

[SSerponi76]

100% false positive.
Add an exception to your Anti-virus for DCS

[That Goth Guy]

I agree it's probably a false positive but it's caused by an incorrectly signed .dll file and I'm not making an exception when it shouldn't happen.

[Tom]

I have seen two dlls so far, the edCore.dll and the flight.dll

[bignewy]

They are most likely false positives but I suggest you submit the files to your security provider for checking.

[Roadrunner]

i uninstalled due to virus detection in update file. Hidden on an external disk. steamapps\downloading\223750\bin-mt\edCore.dll.file: Trojan:Win32/Wacatac.B!ml. could be coincidence? its a particularly nasty virus. Might be worth checking all the same.

[Franz Makamele]

On the beta branch those files are detected as malware:
bin-mt\WorldGeneral.dll
bin\WorldGeneral.dll
bin-mt\edterrain4.dll
bin-mt\Scripting.dll
bin\Flight.dll

I'm not taking a risk and cancelling update until devs will sign those files again.

Edit:

I see that there was similar story with bin\WorldGeneral.dll on previous update (December)

[bignewy]

Originally posted by davidrobertson00:

i uninstalled due to virus detection in update file. Hidden on an external disk. steamapps\downloading\223750\bin-mt\edCore.dll.file: Trojan:Win32/Wacatac.B!ml. could be coincidence? its a particularly nasty virus. Might be worth checking all the same.

you need to supply the quarantined file to your provider for checking, we are not getting it with our antivirus checks. It is most likely a false positive due to encryption

[Troll Norris]

I have no virus warning. MS defender, windows 11

[Franz Makamele]

Originally posted by bignewy:

Originally posted by davidrobertson00:

i uninstalled due to virus detection in update file. Hidden on an external disk. steamapps\downloading\223750\bin-mt\edCore.dll.file: Trojan:Win32/Wacatac.B!ml. could be coincidence? its a particularly nasty virus. Might be worth checking all the same.

you need to supply the quarantined file to your provider for checking, we are not getting it with our antivirus checks. It is most likely a false positive due to encryption

Could you provide hashes for those files from your side for double checking if something wasn't edited in the middle?

[Troll Norris]

I forced fast test by Defender (Note, my CPU AIO cooler went full power. :D) 338449 files in 2 minutes and 35 seconds. No threat found.

[APOSTATE]

False positives. There's no such thing as a risk from developers behind big games like this. Ignore it.

[bignewy]

Originally posted by Franz Makamele:

Originally posted by bignewy:

you need to supply the quarantined file to your provider for checking, we are not getting it with our antivirus checks. It is most likely a false positive due to encryption

Could you provide hashes for those files from your side for double checking if something wasn't edited in the middle?

Nothing can be edited between, the update either comes straight from the steam servers if steam or for stand alone our CDN in Europe.

[Franz Makamele]

Originally posted by bignewy:

Originally posted by Franz Makamele:

Could you provide hashes for those files from your side for double checking if something wasn't edited in the middle?

Nothing can be edited between, the update either comes straight from the steam servers if steam or for stand alone our CDN in Europe.

Well, your statement is not true. During specific attacks, it's possible to stick malware to the files during upload/download to/from servers. So I kindly ask again - provide hashes for those files from devs, please.

[Troll Norris]

bin-mt\WorldGeneral.dll hash SHA256 for DCS:W NON-STEAM version.
BEB65BC4216ABAA37B501C5661CBF91746E31F452C28B55D5C9CD87D5139922C