trojan virus Generik.ICX ESET virus scanner notification

My case with this is abit more complicated i am afraid .... I tried validating the game files once i found the trojan message from Eset and first i got the message that "1 file failed to verify and will be reaquired" . Then aquairing the file which is 2.75 mb in length , the re-downloading stops ans i get no "play" ability . I constantly get the antivirus pop-up that stops the download and no joy ... Any tips ?

thanks and best regards



JayPasta said:
If you have recently installed rFactor 2, your PC may be infected with a Trojan Horse virus (see virus details below). After I was infected, a PC from an IP address in the United States tried to login into my Hotmail account associated with Windows. The virus may be sending sensitive information to a hacker somewhere in the US. Please be careful.

If anyone knows more about what damage this virus can inflict, please let me know with a response to this thread.

Virus Details:

<ESET>
<LOG>
<RECORD>
<COLUMN NAME="ログ">D:\SteamLibrary\steamapps\common\rFactor 2\Bin\Bundles\net.rfactor2.overlay.jar - Generik.ICXNONF トロイの木馬の変種 (Trojan Horse)- 削除によって駆除されました [1]</COLUMN>
</RECORD>
<RECORD>
<COLUMN NAME="ログ">D:\SteamLibrary\steamapps\common\rFactor 2\Bin\Cache\bundle33\version0.0\bundle.jar - Generik.ICXNONF トロイの木馬の変種 (Trojan Horse) - 削除によって駆除されました [1]</COLUMN>
</RECORD>
</LOG>
</ESET>

Thank you.
Click to expand...
 
pace_car said:
noticed the same today....but i didnt use RF2 yesterday

but weird this suddenly has become an issue...am using ESET and RF2 for years together now
Click to expand...

It's really not very weird. The slightest change to either can coincidentally cause a false positive. With user reports the next small update will probably stop it. Then something else will trigger, get reported, etc.

They err on the side of caution.
 
notification of the trojan
 

Attachments

  • Screenshot 2022-04-28 225828.jpg
    Screenshot 2022-04-28 225828.jpg
    27.1 KB · Views: 221
I found this problem yesterday to because my steam is on my d drive i just excluded the whole drive from eset everything works mint now
 
BitDefender is raising questions about a Trojan in the latest update:

upload_2022-4-28_23-20-26.png


Now, before somebody tells me to exclude that folder from scanning, let me ask....why would I want to do that? That's the whole reason for anti-virus. There's been more than one occasion where a game or software update or release has had a virus (in most cases accidentally).

I'm just posting here for the sake of sharing what my A/V is saying....
but you can bet that I'm not going to let this update through for now.
 
CollierT11 said:
BitDefender is raising questions about a Trojan in the latest update:

View attachment 44627

Now, before somebody tells me to exclude that folder from scanning, let me ask....why would I want to do that? That's the whole reason for anti-virus. There's been more than one occasion where a game or software update or release has had a virus (in most cases accidentally).

I'm just posting here for the sake of sharing what my A/V is saying....
but you can bet that I'm not going to let this update through for now.
Click to expand...
watch this thread, there have been several ESET virus scanner users who have gotten this. And now BD as well it seems, but IF it was a real trojan, all of us would be getting warnings.
 
@CollierT11 A/V can't tell you for sure that you don't have a virus, and in many cases it's only guessing that you do (that's what heuristics does). It's a tool to help you decide what to do. So you're absolutely free to avoid the RC if that's your choice, at least until it either changes slightly again (and is no longer picked up) or the A/V definitions are adjusted to no longer flag the false positive. At which point you'd be using the same thing you're avoiding now.

Can never be sure, but the 'group' testing sites are normally a pretty good indicator.
 
Hi all, now I see this thread .... today I had that problem ... I began receiving an "error writing file" during a rfactor2 update/download in steam ... then rfactor2 started but while starting the game I receive a blocking message from my antivirus ... than I excluded the directories (steam/common/rfactor2 and "downloading"), the game starts but when I try to start a race, it does not upload the track ...

that's where I hate rfactor2 (that I still love ...) because when something like that happen, there is no way to have it working fine again ... I already spent two hours for that and now ? what could I do ?

I fear I will have to disinstall it and then reinstall ?
Here I ask your help ... and if I have to reinstall it, which settings files etc should I save before that process, to not have to redefine everything from scratch ?
 
seamount said:
Hi all, now I see this thread .... today I had that problem ... I began receiving an "error writing file" during a rfactor2 update/download in steam ... then rfactor2 started but while starting the game I receive a blocking message from my antivirus ... than I excluded the directories (steam/common/rfactor2 and "downloading"), the game starts but when I try to start a race, it does not upload the track ...

that's where I hate rfactor2 (that I still love ...) because when something like that happen, there is no way to have it working fine again ... I already spent two hours for that and now ? what could I do ?

I fear I will have to disinstall it and then reinstall ?
Here I ask your help ... and if I have to reinstall it, which settings files etc should I save before that process, to not have to redefine everything from scratch ?
Click to expand...
first off, DO NOT un-install. Just a waste of your time when all your DLC begins re-downloading. The simplest procedure is to rename your player.json file and restart rF2. It will create a fresh copy. If that doesn't correct the problem, rename the entire User Data folder. (re-naming preserves all your controller presets which you can copy back when things get up and running.)

rF2 does write to several JSON files when it exits and that makes it particularly vulnerable to corrupted files if the process gets interupted by a CTD, or lately, this virus scanner intrusion.
 
Last edited:
CollierT11 said:
BitDefender is raising questions about a Trojan in the latest update:

View attachment 44627

Now, before somebody tells me to exclude that folder from scanning, let me ask....why would I want to do that? That's the whole reason for anti-virus. There's been more than one occasion where a game or software update or release has had a virus (in most cases accidentally).

I'm just posting here for the sake of sharing what my A/V is saying....
but you can bet that I'm not going to let this update through for now.
Click to expand...


This is pretty much what I am getting too, with latest bit defender update. Mine was bundle33 which was rejected when I attempted a game file verfication. Game file verification was halted immediately and could not be resumed without locking again.

Interestingly, I did a full system scan and bitdefender found the same issue with “several bundle files in a cache folder that I had saved previously on another drive. It was a 2020 instance of cache.

From 2020:
--- Bin\Cache\bundle57\version0.0\bundle.jar=>net/rfactor2/overlay/WebProxy.class Java.Trojan.GenericGBA.31463
--- Bin\Cache\bundle33\version0.0\bundle.jar=>net/rfactor2/overlay/WebProxy.class Java.Trojan.GenericGBA.31463
--- Bin\Bundles\net.rfactor2.overlay.jar=>net/rfactor2/overlay/WebProxy.class Java.Trojan.GenericGBA.31463
--- Bin\Bundles\net.rfactor2.overlay.jar=>net/rfactor2/overlay/WebProxy.class Java.Trojan.GenericGBA.31463

Interestingly, not all of these files were identified, except bundle33 as issues with my 2022 AV observation? So what is different about those files other than bundle33, that they are not flagged by the 04/28 2022 AV update?

So whatever this is it I not new to rFactor 2, but appears to be new to bitdefender?

The problem manifests as:
rFactor 2 UI loads, however in :
Multiplayer:
no animated track loading screen, just a black screen. Only way to get out is to kill rFactor in task manager

Single Player:
- no animated track loading screen. rF2 goes straight to what looks like a partial "watch" screen showing a static camera view, a disfunctional drive button, and exit button(upper left corner). A function gear button in upper right corner. Graphics tab is grossly under populated with minimal functions.
 
Last edited:
dav_0075 said:
i too have the virus I can no longer play! if anyone has a solution thank you
Click to expand...
if your antivirus has the rfactor 2 file in quarantine then this is the reason why you cannot play
just go to quarantine settings find the file and press restore
after that go to antivirus settings and exclude the steam folder so no false alarm will be in the future
 
mesfigas said:
if your antivirus has the rfactor 2 file in quarantine then this is the reason why you cannot play
just go to quarantine settings find the file and press restore
after that go to antivirus settings and exclude the steam folder so no false alarm will be in the future
Click to expand...

Thanks for your answer, I tried but it didn't work.
screen blocked as you can see in the photo ... thank you
 

Attachments

  • 20220429_232350.jpg
    20220429_232350.jpg
    6.2 MB · Views: 200
dav_0075 said:
Thanks for your answer, I tried but it didn't work.
screen blocked as you can see in the photo ... thank you
Click to expand...

Check your a/v logs to make sure it's not quarantining something else. Try verify rF2 files in steam and try again. And check the a/v logs again.
 
You must log in or register to reply here.
Back
Top