test content
  • Games
  • Social
  • Arc News
  • Support
  • Zen
What is the Arc Client?
Install Arc
Forums > Home› Support› PC, Network, and Other Technical Issues› Windows and General: PC, Network, and Other Technical Issues

Possible trojan in patch?

snowmarshmallowssnowmarshmallows Member Posts: 0 Arc User
edited May 2013 in Windows and General: PC, Network, and Other Technical Issues
While patching today, my antivirus is claiming \Star Trek Online\Live\libcef.dll is a trojan.

It's probably a false positive, but it could be a significant issue if it's not.
Post edited by snowmarshmallows on

Comments

  • dirlettiadirlettia Member Posts: 1,632 Arc User
    edited May 2013
    Not coming up as a virus under Avast antivirus. Which antivirus are you using and also check the file version to make sure a malicious program hasn't changed it.

    My own version shows as;

    file version: 1.1180.1112.0
    product version: 1.1180.1112

    size 21.1MB
    date modified: 17/03/2013 04:12
    Still waiting to be able to use forum titles
  • jelly0jelly0 Member Posts: 560 Arc User
    edited May 2013
    I dont even have that dll file oO

    Edit
    Ah its in the test folder not live for me.
  • pwebranflakespwebranflakes Member Posts: 7,741
    edited May 2013
    Thanks for the report, Captains. What AV are you using? I?d like to pass this info along to the team.

    Cheers,

    Brandon =/\=
  • gamerjoshgamerjosh Member Posts: 158 Arc User
    edited May 2013
    I checked my file, the details match the ones posted above, passed all virus checks with windows defender, windows 8.
    Belief manifests reality
  • kurumimorishitakurumimorishita Member Posts: 1,410 Arc User
    edited May 2013
    Checked mine with AVG.. passed - no virus.
    "We might get pretty singed at that range, but not as singed as they're going to get. Engage."
    - Captain Six of Nine aka Ashley "Don't Call Me Ash" Campbell
    q4F10XV.jpg
    Join the Armada!!!
    ALWAYS OUTNUMBERED, NEVER OUTGUNNED
    KM on DeviantArt
    KM on Imgur | KM on Twitter
  • arctrooper1773arctrooper1773 Member Posts: 0 Arc User
    edited May 2013
    DLL files are shared libraries for your operating system. That means that more than one program will access the dll file - they can also be statistically linked which will allow an executable file (essentially that thing you double click on) to load the information from more than one at a time into memory and start doing what the code is asking it to.

    If it's a data file in dll format, it can look similar to a simple antivirus scan - a trojan is a seemingly innocuous program that contains malicious code that is not accessed by the program it's telling the computer it's for.

    Trojans are also typified by a random number generator that will prevent the malicious code from executing until a certain point (makes it harder to pinpoint where the virus came from). DLL files are also able to delay this - especially if the program the DLL is there for can't find it (i.e. it's being downloaded at that moment).

    Would you like to know more? (cookie for the one who gets this)


    It looks like the antivirus just picked it up because it has similarities to the more simple malicious code. Nothing to worry about - you'll get this with anything from STO to a printer installation.

    The main thing you need to think about though is that even if the source is one you trust (perfectworld and, say, HP being perfect examples), they may have been attacked and a virus may have been saved as part of the download. It's incredibly unlikely, but as they say, the safest computer is one that doesn't have an internet card.
  • raepokraepok Member Posts: 0 Arc User
    edited May 2013
    If you mean the reference it's Starship Troopers...
  • sfccrashsfccrash Member Posts: 0 Arc User
    edited May 2013
    I've checked this file at work using 3 different AV programs, ESET, Symantic, and AVG all come clean with the file. Definitely sounds like a false positive to me there.
    Former L2 player. Hope this one is better with botters, got sick of one person running a full 9 man group.

    SFC Crash. formerly of HG on the formally known gustin server of L2.
  • speedyonpwispeedyonpwi Member Posts: 2 Arc User
    edited May 2013
    checked with microsoft security essentials, no positives there :D
  • ki451ki451 Member Posts: 0
    edited May 2013
    gamerjosh wrote: »
    I checked my file, the details match the ones posted above, passed all virus checks with windows defender, windows 8.


    VirusTotal shows it clean:

    https://www.virustotal.com/en/file/aa6cf1f192bc2656d5c766c38537adceab2a7f80c0540cf2f7e50073bd672948/analysis/1369183519/
  • xcom43xcom43 Member Posts: 723 Arc User
    edited May 2013
    I have 5 cleaning programs and non of them are giving a flase positve.

    AVG/malwarebytes/ASC6/ccleaner/Iobit malware:D

    But it has been knowen to happen with other mmos.
    The fear of death follows from the fear of life. A man who lives fully is prepared to die at any time.
  • lombarduslombardus Member Posts: 1 Arc User
    edited May 2013
    Hi I'm also getting a virus warning for libcef.dll (path: ....Cryptic Studios\Star Trek Online\Live\libcef.dll).

    ESET is saying its a variant of Win32/Kryptic.AGJL trojan.

    It's repeatedly deleting the file resulting in the launcher having a "file locked" error and restarting.

    Any assistance will be greatly appreciated.
  • arctrooper1773arctrooper1773 Member Posts: 0 Arc User
    edited May 2013
    raepok wrote: »
    If you mean the reference it's Starship Troopers...

    Oh go on, you can have two.

    e96d_spock_cookie_jar.jpg
Sign In or Register to comment.