******* !!!!!! Luhe.Fiha.A Virus found in SniperElite3.exe !!!!!! *******

[deltaagent26]

locations: \steam\steamapps\common sniper elite 3\bin\sniperlite3_mantle.exe
\steam\steamapps\downloading\238090\bin\sniperelite3.exe
c:\users\xxxxxxxxx\downloads\9f13.tmp
c:\users\xxxxxxxxx\downloads\da.tmp
c:\users\xxxxxxxxx\downloads\bcac.tmp



AVG Anti-virus detected this during routine scanning.

\Edit/
Also found by malwarebites anti-malware...this is not a false positive!

For those of you who made the exception in avg, I would strongly advise that you delete the game, and rescan your systems with multiple secruity software programs.

Luhe.Fiha and all of its 58 variants replicate, and can infect other files, eventually causing hard drive failure, they are also known for deleting data.

[deltaagent26]

Rebellion původně napsal:

This is a false positive. The .exe will have changed slightly with the introduction of Mantle. If you can verify you game cache then make an exception in your internet security for Sniper Elite 3 the game should work correctly.

Let me know if you run into any further issues.

Thank you for the timely reply. And a promise of action. However.... however small the possibility may be, could your storage (company or personal) have possibly been compromised, which could in turn have compromised the release of the update to steam users?

It was not a false positive. I was fortunately able to track down and manulally delete all of the infected files before it spread too far. (I had to delete and reinstall several other games afterwards)

I also deleted/shredded the contents of:
c:\users\xxxxxxxx\downloads
c:\windows\prefetch
c:\windows\temp
c\:users\xxxxxxxx\appdata\local\temp

Then rebooted my machine, and rescanned with Avg Internet Security 2014, full-system scan, and anti rootkit scan. neither of which detected any threats.

I also scanned with Anti-malwarebytes Anti-Malware (corporate edition), did a full system scan.
No malicious files or malware, found.
Also scanned with mbar (malware bytes antimalware rootkit scanning tool) no malicious files found.

\Edit/
Also ran:
CCleaner 384Mb cleaned.
Registry Cleaner - 6 items removed/repaired

[TV-32]

Sorry guys, dont trust you anymore, gonna delete the game and would be very suprised if i bought any of your products again, was a pretty ♥♥♥♥♥♥ game anyway

[SynRG]

YUUUUP!!!....Guess what.....same here......I have removed the game entirely until problem is fixed. Tried to contact the game developers through steam support but all I got was dead ends.....NOT HAPPY :o(

[TC | ComputerCrash]

https://www.virustotal.com/de/file/befb6b86a75f58c0472ad7ad31a7284be62383f857abdc73611a806daec1f871/analysis/1412283621/
Virus Total Link. Only Avast detect it. Looks like a false positiv

[Makikomi]

Come on guys, be fair!

Yes, this is a ♥♥♥♥-up on Rebellion's part, but they have already acknowledged it and are trying to rectify it ASAP.

Give them a chance to deal with it before turning your back on Rebellion (and their games) completely.

If they'd ignored the problem, or if they gave you crap service in terms of sorting it out, you'd be justified in that kind of reaction, but I think a little patience is warranted.

I often find that the quality of a company of a product or company can be best judged in seeing how they deal with problems.

[tomcat101]

Same for me !! now we do what??? play or not play with sniper elite 3?? AVG detect it!!

[Superczar]

This isn't the first time a game has had a false positive, it's not the end of the world.

[tomcat101]

I delete Sniper elite 3 right now, I not understand Steam not watching her business better of that,look very very amateur for me.

[tomcat101]

False positive??? explain to me please i not understand this paradoxe

[brok328]

Just wanted a quick half hour play before bed, then I get AVG saying I have this virus and now the game won't load!! Hope there is a patch tomorrow :(

[t3hl33tdruid]

tomcat101 původně napsal:

False positive??? explain to me please i not understand this paradoxe

a false positive means that its giving the file as a virus due to similar code or a misreading of the file, it happens sometimes with AVG and other programs that just read something as a virus when it happens, false positives are unusual, but they happen with games more often than anything else

[deltaagent26]

Direct quote from avg threat labs on this virus....

"What is Luhe Fiha?

Luhe Fiha is a malicious software that once it is exceuted has the capability of replicating itself and infect other files and programs. These type of malware, called Viruses, can steal hard disk space and memory that slows down or completely halts your PC. It can also corrupt or delete data, erase your hard drive, steal personal information, hijack your screen and spam your contacts to spread itself to other users. Usually, a Virus is received as an attachment on an email or instant message.Luhe Fiha is currently ranked 71 in the world of online malware"

It goes on to state:

"How can I remove Luhe Fiha?

While surfing online
If you received a pop-up warning for Luhe Fiha while you were surfing a website, chances are that the malware was blocked and there's nothing to remove.

During your regular activity
When AVG real-time antivirus protection detects a virus in your computer, the AVG Detection window is displayed, with two options:

Protect Me: this is the recommended action. It will remove the threat from your device.

Ignore the threat: will do nothing to remove the virus, however the file will be blocked so infection won't spread.

It is recommended to perform a full device scan after dealing with any threat, to make sure it was successfully deleted.

For more detailed advise on more specific situations, please visit to our Virus Removal FAQ section."

[t3hl33tdruid]

AVG routinely is a bit overzealous in things like this, I have had it give false positives more often than any other antivirus program

[6runk]

Not getting into any opinions etc... just sharing my 5 cents:

More often than not, something gets flagged as malicious, hazardous or general malware by Anti Virus software. In this case, with a reputable Developer and a reputable Platform (Steam), it is most likely a false positive.

Having used AVG for over 5 years now, I can only concur, it has a tendency to be a bit... to picky; then again, using a decentralized method of gathering information on suspected threads, this will happen.

If it makes you feel better, remove it and (patiently) wait for Rebellion to address it correctly. It is only in their interest to do so, so they will.

Also, please don't be too flustered by this, there is over 100 well renown Anti Virus publishers and even more sketchy ones. There's simply no easy way of always guaranteeing that false positives won't occur for all of them, all the time.

In closing, if you are so upset by this, then by all means, turn your back on the game, the franchise and the developer. But please, don't poison the game or the community because of it. I am quite astounded by the fact that someone from Rebellion replied to this thread, and quite promptly too I might add.

Anywho, it will be taken care of.

Cheers

[deltaagent26]

I never said anything bad or negative about, nor have any ill-will towards the developer, or its game(s). I only posted as to the possibility of a corrupted update. Those whom choose to view the developer in a negative way, have done so of their own accord.