trojan virus Generik.ICX ESET virus scanner notification

Any update on this from the devs? It's a bit concerning that without a real update suddenly this issue pops up. It could be the RFactor files, but ofcourse also new antivirus database definitions
 
Masterrenderer said:
Any update on this from the devs? It's a bit concerning that without a real update suddenly this issue pops up. It could be the RFactor files, but ofcourse also new antivirus database definitions
Click to expand...

Isn't that why it's not concerning?

The .jar being picked up has a handful of small class files. Not surprisingly it has some sort of data access (net sockets and the like), which is why it will be more prone to being picked up as a false positive. Just like when you script a small installer/uninstaller (that, not surprisingly, can install and remove files, and uses the registry to decide what to do) and it gets picked up - because in broad terms it's doing the same thing some malicious code will want to do.

If you own/run antivirus you should understand what it's doing. Do you trust rF2/Steam? Then create an exception.
 
hi,
yesterday my virus software quarantined
net.rfactor2.overlay.jar

because it contained
Dldr.Adwind.svfgb

which stopped rf2 from loading.

i verified the game files, which caused the net.rfactor2.overlay.jar file to be re-downloaded, and the virus software quarantined it again straight away.

please can this file be cleaned so i can re-install it and use the software again?

thanks in advance!
 
Same problem here. But more serious, because the net.rfactor2.overlay.jar file is directly deleted by the antivirus. It does not even leave it in quarantine (Eset Nod32). And although the destination folder of that file excludes it from the analysis, it does not allow downloading said file when verifying rFactor2 in Steam, nor copying it from the backup copies. And if I completely deactivate Eset Nod32, it is the Windows antivirus that does the same thing, it does not allow it to be copied or installed on the computer.

Therefore impossible to execute rFactor2
 
Virus total says;
IMG20220505172121.jpg
 
I can happy say Avira no longer blocks these files now.
3 days ago I sent the 2 files to their virus lab via their website.
Had reply back saying "The analysis you requested is now complete: Files are clean."
I've tested, I can confirm the files are not blocked no more by my virus checker Avira.
 
JMCardenas said:
And although the destination folder of that file excludes it from the analysis, it does not allow downloading said file when verifying rFactor2 in Steam, nor copying it from the backup copies. And if I completely deactivate Eset Nod32, it is the Windows antivirus that does the same thing, it does not allow it to be copied or installed on the computer.

Therefore impossible to execute rFactor2
Click to expand...
When Steam downloads files, they first go to a temporary location first before they are copied to rFactor. You will need add exclusions to that folder too. The folder is found at ......\SteamLibrary\steamapps\downloading\
See post number 8 https://forum.studio-397.com/index....irus-scanner-notification.71825/#post-1096254
 
Last edited:
Giovanni Cavallazzi said:
I have the same problem, my rFactor2 don't works. It starts but I can drive and don't exit. What can I do?
Click to expand...

Create an exception for the files/folders that are being picked up. Google for instructions for your particular antivirus.

*Note: half this thread is dedicated to people explaining what to do. Please read it!
 
error o virus.png
Same here, with Microsoft Defender. It detects a malicious program(1) and the affected files(2) and started on the night of May 5th. The funny thing is that the infected bundle.jar file does not delete it, the other does. I have to check the files in Steam every time I want to play, because when I finish and exit RF2 I get the Defender notification and the overlay.jar file doesn't show up.
It lets me start the game, but when it is going to start loading the circuit it crashes.
 
The Steam GameOverlayUI program, I think, has something to do with it??
Now the circuit loads but it won't let me leave the box, the session and the weather don't appear, it's as if I hadn't finished loading the session.
The GameOverlayUI program log tells me this:

Fri May 06 14:26:26 2022 UTC - GameOverlay process started: pid: 992
Fri May 06 14:26:26 2022 UTC - GameOverlay process connecting to: pid: 9548
Fri May 06 14:26:26 2022 UTC - BuildID: 1647446817
Fri May 06 14:26:26 2022 UTC - Steam Path: C:\Program Files (x86)\Steam
vi. may. 06 14:26:26 2022 UTC - Got gameid on commandline: 365960
vi. may. 06 14:26:26 2022 UTC - PNG load warning iCCP: known incorrect sRGB profile
vi. may. 06 14:26:26 2022 UTC - PNG load warning iCCP: known incorrect sRGB profile
vi. may. 06 14:26:26 2022 UTC - PNG load warning iCCP: known incorrect sRGB profile
vi. may. 06 14:26:26 2022 UTC - PNG load warning iCCP: known incorrect sRGB profile
vi. may. 06 14:26:26 2022 UTC - PNG load warning iCCP: known incorrect sRGB profile
vi. may. 06 14:26:26 2022 UTC - PNG load warning iCCP: known incorrect sRGB profile
vi. may. 06 14:31:03 2022 UTC - Detected possibly crashed/killed game, exiting
vi. may. 06 14:31:03 2022 UTC - Shutting down overlay
 
Alex96 said:
View attachment 44759 Same here, with Microsoft Defender. It detects a malicious program(1) and the affected files(2) and started on the night of May 5th. The funny thing is that the infected bundle.jar file does not delete it, the other does. I have to check the files in Steam every time I want to play, because when I finish and exit RF2 I get the Defender notification and the overlay.jar file doesn't show up.
It lets me start the game, but when it is going to start loading the circuit it crashes.
Click to expand...

I don't have 1, and opted to go into Defender and allow the Overlay to run. That's how it all works.
 
Alex96 said:
Now the circuit loads but it won't let me leave the box, the session and the weather don't appear, it's as if I hadn't finished loading the session.
Click to expand...
This is caused by missing net.rfactor2.overlay.jar file in Bin\Bundles folder, which the file was blocked or deleted by defender. You will have to first add this file to defender's exception (the first screenshot you posted, Acciones button), and if the file is only blocked it will then be restored by defender. If the file was deleted by defender already, then you need to verify game file integrity through steam to restore it.
 
So, there has been an actual trojan in the rF2 installation? Should i format my PC and reinstall windows?? Why are there no clear instructions from the dev team.
 
Hiigara said:
So, there has been an actual trojan in the rF2 installation? Should i format my PC and reinstall windows?? Why are there no clear instructions from the dev team.
Click to expand...

No, there is no trojan. No, you don't need to format your PC.

Please learn what a false positive is.

@Oldgamergazza I'm sure they'll adjust their detection at some point to let it run, but you should be able to create an exception as others have detailed in this thread.
 
svictor said:
This is caused by missing net.rfactor2.overlay.jar file in Bin\Bundles folder, which the file was blocked or deleted by defender. You will have to first add this file to defender's exception (the first screenshot you posted, Acciones button), and if the file is only blocked it will then be restored by defender. If the file was deleted by defender already, then you need to verify game file integrity through steam to restore it.
Click to expand...
Thanks for the innformation, Svictor.
 
You must log in or register to reply here.
Back
Top