ESET antivirus is blocking update files

[neuman]

Hi All ,

Last update cannot be completed because ESET Internet security blocks them because of Win64/Packed.VMProtect.AC ???

I have seen the post of the Italian gut how to exclude this however he did not put in the whole path..can someone help me here?

Cheers

[RacingA5]

DCS 2.9.4.53549 update - Viruses found

My Eset Smart Security Premium found 14 files with virusses.

[Spec]

my eset antivirus is also not letting files through.

[Troll Norris]

DCS:W uses VMProtect. Some antivirus softwares are very sensitive to this. Those files are encrypted. Antivirus software can not know the real content of those files. It sees only its encrypted form. No real data. Thus most probably false positive.

I guess most of those are dynamic library files.

[Spec]

sounds reasonable. Thanks.

[SSerponi76]

False positive

[Spec]

Maybe one more question, is that VMProtect a new feature because I haven't seen this behaviour before when updating.

[Troll Norris]

No, VMP is used for years. It is used as part of "new" keyless DRM and as intellectual property protection to not steal data from DCS to make own game out of it. Aircraft development in DCS requires diligent research on aircraft and their systems. ED does not want to give someone the opportunity to just "copy" this data into their game. For Example Ali Mahvan and his TWS scam.

Problem is that VMProtect is also misused by hackers. They encrypt malware by this software so the antivirus can not detect it.

[Spec]

So i guess the eset rules got stricter after an update or something.

[Troll Norris]

Oprindeligt skrevet af Spec:

So i guess the eset rules got stricter after an update or something.

There might be some issue with for exaplme singature of the files. This is not the first time that antivirus flagged this files. You can find at least one person every month for more than like 3 years.

[Troll Norris]

If you are not sure, you can send the sample to antivirus lab to make sure the file is o.k.

[bladerunner97]

I had to make an exception in ESET for 'Steam\steamapps\downloading'. There were 44 .dll files getting quarantined thanks to VMProtect, which put the whole downloading/updating process into a non stop loop.

Update:
To actually play the game, I also had to add an exception for Steam\steamapps\common\DCSWorld. Otherwise three more files would get quarantined. Forcing me to 'verify files' again, ad infinitum.

[Saint_Genius]

Following the update game continues to crash.

[bignewy]

Hi all,
it seems to be false positives also being discussed here on our official forum

https://forum.dcs.world/topic/346733-eset-antivirus-latest-update-april-10-causing-virus-warnings-and-seems-stuck/

[ian]

Like in most AV & Firewall packages, you can exclude files, folders and unblock HTTP/ IP requests.

It depend if it DCS World folders found under C:\program files\DCSWorld, or Steamapps DCS User folder causing the error. Or its the one under you C:user<name>/Saved Games folder or another folder causing you update error, I would exlue all DCS folders for now.

However For ESAT have you tried
To exclude a folder from scanning in ESET, you need to123:
1. Open the main program window of your ESET Windows product.
2. Press the F5 key to open Advanced setup.
3. Click Detection Engine, expand Exclusions and click Edit next to Performance Exclusions.
4. Click Add, type the directory that you want to exclude from scanning into the Path field
and add a comment for the exclusion in the Comment field.
5. Click OK.

[neuman]

Oprindeligt skrevet af ian:

Like in most AV & Firewall packages, you can exclude files, folders and unblock HTTP/ IP requests.

It depend if it DCS World folders found under C:\program files\DCSWorld, or Steamapps DCS User folder causing the error. Or its the one under you C:user<name>/Saved Games folder or another folder causing you update error, I would exlue all DCS folders for now.

However For ESAT have you tried
To exclude a folder from scanning in ESET, you need to123:
1. Open the main program window of your ESET Windows product.
2. Press the F5 key to open Advanced setup.
3. Click Detection Engine, expand Exclusions and click Edit next to Performance Exclusions.
4. Click Add, type the directory that you want to exclude from scanning into the Path field
and add a comment for the exclusion in the Comment field.
5. Click OK.

Hi Ian,

Thank you for your detailed answer. I did it a bit differently and I post it here for other people:

(your 1, and 2 stages are the same. In stage 3 I clicked the Edit next to the Detection Exclusions.

4. I clicked "ADD" and in the "Path" window I inserted the path to the Downloading folder in dcs => C:\Program Files (x86)\Steam\steamapps\downloading, and in the "Detection Name" window I did put: Win64/Packed.VMProtect.AC

Then I did the file verification of DCS whaich has re-loaded 22 files and all is good as far as I can tell.

Hopefully ESET abd/or DCS will solve this issue later.

Thanks again and all the best

Isaac