Trojan just attempted to infect me, targeted BGT

[Katsai]

Well, after today's update, it's no longer flagged by Avast. Going with false positive on my box.

[Lance_Lake]

I got it on Avast as well. I deleted it (moved it to chest actually) and had steam verify the files. Didn't get another warning.

[dukmiester2]

Norton Internet Security 2011 found it too. It put it in quarantine(deleted it). Had steam verify files, and all was OK, and it did not replace the file.
I then ran BGT in arcade mode, ran fine. Then, did another scan of the BGT folder and steam had put it back, apparently, when I launched BGT. See below:


e:\valve\steam\steamapps\*******\bloody good time\bin\unitlib.dll
____________________________
____________________________
On computers as of:
12/30/2010 at 8:58:01 PM
Last Used:
12/30/2010 at 9:20:26 PM
Startup Item:
No
Launched:
No
____________________________
____________________________
Many Users
Thousands of users in the Norton Community have used this file.
____________________________
High
This file risk is high.
____________________________
Threat Details
Threat type: Virus. Programs that infect other programs, files, or areas of a computer by inserting themselves or attaching themselves to that medium.
____________________________
Origin
Downloaded from URL Not Available


Source: External MediaSource File:
steam.exe
File Created:
unitlib.dll

____________________________
File Actions
Infected file: e:\valve\steam\steamapps\***********\bloody good time\bin\unitlib.dll
Removed
____________________________
File Thumbprint - SHA:
Not Available
____________________________
File Thumbprint - MD5:
Not Available
____________________________

Of particular interest is the part in Bold.
Since Steam.exe keeps putting it back, I must assume it is a false positive.

[CyberSoniX]

my Avira Antivir also complained about this file.

bloody good time\bin\unitlib.dll
[FIND] Is the trojan horse TR/Dldr.Injecter.eym

[djTeka]

Same thing as dukmiester2, happened just now with Norton, probably a false positive.
This is OuterLight we're talking about, and I trust them.
I can't say the same about UbiSoft, the publisher who pulled the rug out from OL.
(Yes, I know they are making the 'constant online' games only need to connect when they start, but still...)

c:\program files (x86)\steam\steamapps\~~~~~~\bloody good time\bin\unitlib.dll
____________________________
____________________________
On computers as of:
12/23/2010 at 11:20:56 PM
Last Used:
1/3/2011 at 9:21:34 PM
Startup Item:
No
Launched:
No
____________________________
____________________________
Many Users
Thousands of users in the Norton Community have used this file.
____________________________
High
This file risk is high.
____________________________
Threat Details
Threat type: Virus. 
Programs that infect other programs, files, 
or areas of a computer by inserting themselves 
or attaching themselves to that medium.
____________________________
Origin
Downloaded from  URL Not Available


Source: External MediaSource File:
steamtmp.exe
File Created:
steam.exe
File Created:
unitlib.dll

____________________________
File Actions
File: c:\program files (x86)\steam\steamapps\~~~~~~\bloody good time\bin\unitlib.dll
Removed
____________________________
File Thumbprint - SHA:
Not Available
____________________________
File Thumbprint - MD5:
Not Available
____________________________

I turned off all my Norton services with the 15 minute option, of note is the *Auto-Protect* feature,
also known as 'That file looks strange, not very many people have it, and it kinda reminds me of a virus. I'm quarantining it.' Mode.
I then made it restore the file, told Norton "Be cool" by specifying the file as being fine, *exonerating* it from autodelete hell.
Norton hasn't complained yet.

[Goteki-45]

Just experienced this when moving my Steam directory to another drive (as I have my AV ignore Steam on my main drive to avoid false positives in games).

If the Outerlight devs are still reading this forum, maybe they can talk with the AV companies so they stop flagging this file?

I've got McAfee VirusScan Enterprise.

[Wighar]

Listed by several antivirus software

MD5: 2b81835884e7e78c6cb9f0fd39d4c801
SHA256: 4025cdc9a544a8146cb8ad7716095bca8013edd94000edce21 da6cd28ab4418f


http://www.virustotal.com/file-scan/...18f-1301703411

I have no clue what the file does myself, if its part of the internet MP part of the game I would not know since i play SP/Arcade mostly

[adz]

i get this also, Eset Smart secuity

[adz]

so i take its a false positive?