Battleye update fails because of potential malware in BEClient.dll

[spofny 3]

Since this afternoon I can't enter any server.. The Battleye update fails because my antivirus (antivir) thinks the BEClient.dll is a trojan.

It doesn't usually do this.. So it's either a false positive or the Battleye website has been hacked..

Virus or unwanted program 'TR/Downloader.Gen [trojan]'

detected in file 'C:\Users\lkaslkdfnas\AppData\Local\ArmA 2 OA\BattlEye\BEClient.dll

Edited January 15, 2013 by spofny

[PK Richie 507]

You could add an exception to your anti-virus ? Tell it to ignore the file

[OmaOhneBH 0]

Same here.

But what if the website is hacked?

Edited January 15, 2013 by OmaOhneBH

[adeptus astartes 20]

Same happening to me. Running a few of the usual programs just to be safe and not touching the game until after.

[spofny 3]

"You could add an exception to your anti-virus ? Tell it to ignore the file"

Yes I know, but I'd like confirmation from the Battleye guys before I do so...

Edited January 15, 2013 by spofny

[PK Richie 507]

Yes I know, but I'd like confirmation from the Battleye guys before I do so...

You're better off contacting them :) http://www.battleye.com/impressum.html

[SmashT 10907]

I've PM'd Sable. What anti-virus are you guys using, all Avira AntiVir?

Edited January 15, 2013 by smasht_AU

[adeptus astartes 20]

Avira is complaining, Malware and Spybot seem unfazed.

[Nyarlathothep 0]

I've PM'd Sable. What anti-virus are you guys using, all Avira AntiVir?

I have the same Problem and i also use avira.

Greets

[OmaOhneBH 0]

Yep, Avira.

[tsandrey 379]

It's not hacked LOL

This happened to PB before. The way BE works probably bothers Avira a bit, so it causes a false positive alert. If you downloaded BE from the website or it updated ingame, you should be fine.

[Sutinen 635]

Happened to me twice today, Avira whining about trojans..

I'm not taking any risks either, so I want some info before I ignore the file.

Edited January 15, 2013 by Sutinen

[spofny 3]

It's not hacked LOL

This happened to PB before. The way BE works probably bothers Avira a bit, so it causes a false positive alert. If you downloaded BE from the website or it updated ingame, you should be fine.

Battleye seems to download the file automatically regardless of what version is installed. I've downloaded the file from the webpage and I still get kicked off the game for not being able to update the file..

[$able 257]

Please report this to Avira as a false positive and put the BEClient.dll on your exception list for the time being.

Edited January 15, 2013 by BEdev-Sable

[Buffjesus 357]

I've PM'd Sable. What anti-virus are you guys using, all Avira AntiVir?

yup im using avira antivir

comes up as a trojan for me

[$able 257]

According to https://www.virustotal.com/file/903525a103c1e1bbb18f0e3687dbad0de497a7d1a74704a19d20903d6e0af904/analysis/1358307158/ the Avira AntiVir false positive should be fixed already.

[Purtsi 0]

I'm having the same issue. On Tuesday "failed to update" showed up, yesterday it didn't and today it's kicking me out of the servers again. I also have Avira.

[$able 257]

I'm having the same issue. On Tuesday "failed to update" showed up, yesterday it didn't and today it's kicking me out of the servers again. I also have Avira.

Please follow my advice above.

[AnarKus 0]

According to https://www.virustot...sis/1358307158/ the Avira AntiVir false positive should be fixed already.

Mysterious Tr/downloader.gen That Infects \system Volume Information\

BEdev-Sable is right

http://www.avira.com/en/support-threats-summary/tid/3907/threat/TR.Downloader.Gen

Side effects:

• Downloads malicious files

PD: Battleye is an Anti-cheat that need comunication (down&upload files ServerBE/YourPC) it want a program or dll (kind Trojan) for this. But no is malicious .

Edited January 17, 2013 by AnarKus

[$able 257]

Mysterious Tr/downloader.gen That Infects \system Volume Information\

http://forum.avira.c...&threadID=69413

BEdev-Sable is right

It's a generic/heuristic detection, hence "TR/Downloader.Gen".

[Jonteee_l 1]

Same here.. i got avira and it says it's a Key gen or some gen thing.. i tried to play on my server but since battleye is fucked up i can't install the new patch.. and then i can't play on my own server.. :(

[Allie (DayZ) 97]

Antivirus software is the biggest virus by itself !

[Dayzo 182]

Note sure why virustotal isn't reporting the false positive; I'm still getting it.

I'm sure a few people have reported this false positive already though, including myself.

In the meantime, just add the BEclient.dll to the 'real time protection' exceptions.

(There are other exceptions, so ensure you use the correct section).

I think you have to allow the copy that's in your users appdata folder, rather than the one in your Arma 2 folder.

Eg: c:\users\[your name]\appdata\local\ArmA 2 OA\BattleEye\BEClient.dll

Edited January 17, 2013 by Anti

[starwarsfan@gmx.de 450]

I just turn off the Realtime Scanner while the file updates, once you're ingame you can turn it back on and it won't hassle you. But you have to do that everytime you log back onto a server. <_<

[Jonteee_l 1]

^^

Edited January 17, 2013 by Jonteee_l