Zucker Blatt May 29, 2015 @ 6:58am
Kaspersky warning
Since yesterday kaspersky says, that Steamservicetmp.exe is an trojan
and delet it.

< >
Showing 1-15 of 30 comments
ReBoot May 29, 2015 @ 7:14am 
Where is it and what's the name of the Trojan?
SOLENY 1/2 May 29, 2015 @ 7:15am 
awaw
Zucker Blatt May 29, 2015 @ 7:24am 
1: steamservice.exe = unknow danger
2: PDM:Trojan.Win32.Generic (C:\program files (x86)\common files\steam\steamservicetmp.exe) = Malware
ReBoot May 29, 2015 @ 7:27am 
False positive. That is, tell Kaspersky to ignore it.
crunchyfrog May 29, 2015 @ 1:02pm 
Yes, this pops up from time to time - if it's Steam files, then it's false positive.

ONLY allow them, Still assume other files, if they crop up are malicious.
same thing is happening to me. what do I do to keep it from happening?
Nerv0us7 Jun 1, 2015 @ 5:51pm 
yepp
ReBoot Jun 2, 2015 @ 12:16am 
Originally posted by jhr_digitalartist:
same thing is happening to me. what do I do to keep it from happening?
Use your AVs exception feature or switch to a less paranoid AV.
Azza ☠ Jun 2, 2015 @ 12:27am 
Kaspersky is quality protection.

I've never had this issue with it myself, however nor do I have that file located under the steam folder (only steamservice.exe). Those ???????Tmp.exe files are most likely used when Steam updates older versions to new (keeping a backup of the old or new to swap over), it might of just thought it was odd as it didn't remove/update or something. Worth looking into.

Look up the location of the file...

Right-click the file > Properties > Digital Signatures, is it valid and signed by "Valve".

PDM:Trojan.Win32.Generic - Means it's unknown but triggered off a trojan like process, most likely trying to send data out to a server. Yes, it can be a false positive, but it's just suggesting you should check it out and ensure it's safe.
Last edited by Azza ☠; Jun 2, 2015 @ 12:31am
ReBoot Jun 2, 2015 @ 12:28am 
I wouldn't call paranoia "quality".
Azza ☠ Jun 2, 2015 @ 12:35am 
Originally posted by ReBoot:
I wouldn't call paranoia "quality".

Application control and Firewall is the way to go... knowing what everything is doing and monitoring it. Virus definitions just don't cut it, can easily be bypassed. Most people are just blind to their infections.

AV TEST: http://www.av-test.org/en/antivirus/home-windows/

Sort by performance/security tabs, you will notice all application control virus scanners get top ratings. Virus definition only, such as Microsoft Security Essentials, only detects 65% of infections and therefore gets 0.5 out of 6 rating failing each year.

Anyways...

When steam updates itself, it first creates 2 temporary steam.exe files (for example), called "steamTmp.exe" and "steamNew.exe" and then tries to delete the old Steam.exe and swaps them over. This is due to Windows locking/protecting/using the file at the time. If that tmp.exe file is still there, either the update failed or it's just left over backup file. Either way something might of went wrong, the file signature might be corrupted and Kaspersky has most likely just picked up on that.

Trojans can also fake the real steam files, using the same naming. "SteamWebHelper.exe" being the most commonly used, located somewhere else other than the steam/bin folder is most likely a Stimilik trojan.
Last edited by Azza ☠; Jun 2, 2015 @ 12:47am
SHINOBI Jun 2, 2015 @ 12:37am 
.
Sepukuser Jun 2, 2015 @ 1:06pm 
After today's update I had the same problem with Kaspersky , weird they did not doing with this ...
Azza ☠ Jun 2, 2015 @ 1:32pm 
I use Kaspersky, updated and didn't have any issues or warnings with it.

It however appears for you to be due to copying of files when updating Steam Client.

Either the file signature isn't valid/corrupted or the file transfer is getting stuck/blocked perhaps by Windows or something? A temporary file is left over, then Kapersky active scanner detects that as a possible threat because the security level of it would be at 0 - Unknown, plus have code in it which can access the net, etc.

What Operating System are you using?
Do you have full admin rights/access?
Last edited by Azza ☠; Jun 2, 2015 @ 1:36pm
crunchyfrog Jun 2, 2015 @ 5:54pm 
Originally posted by PaVo:
After today's update I had the same problem with Kaspersky , weird they did not doing with this ...

Firstly, as it's only recenty turned up and it's been the weekend, they might only just be aware of it.

Secondly, it happens from time to time. It's only a section of code somewhere that resembles a piece of code in known malware (a bit like the word "smiles" contains the word "mile"). They will undoubtedy update it in the next few days.
< >
Showing 1-15 of 30 comments
Per page: 1530 50

Date Posted: May 29, 2015 @ 6:58am
Posts: 30