Planetside.exe virus Win32: Hoblig [Heur]

Discussion in 'Player Support' started by Renegade, May 11, 2013.

  1. Klemens

    I got the virus warning as many others did. I changed from Avast to F-Secure and everything installed fine. I reinstalled Avast again after uninstalling F-secure and made a scan on the disks and MBR for rootkits and it found nothing (I'm back to F-Secure now). I have no infected files what-so-ever and my computer works just fine. AV-Comparatives report that avast has a very high risk for misreading heuristics.

    The file only has a 1/47 detection rate on VirusTotal. It is not a virus. It is just badly written game-code in the latest patch that avast misinterpret as a virus.

    I understand the paranoia people have, but this is a false/positive and nothing to worry about. It's safe to install.
  2. DownhillDino

    I'd post proof if I could, but the computers are of course clean now. Maybe if I feel like trying to update again and get the virus again, I'll show you. But in the meant time, I know what I saw, and it was a virus from Planetside 2.
  3. EmmeraldWeapon


    [IMG]
  4. TSR-SeanF Customer Service

    PlanetSide 2 has no viruses associated with the client. The issue you are encountering with Avast flagging the program is a false positive, and nothing more. We are currently working to resolve this issue and should have it addressed as soon as possible. In the mean time, you can safely add any necessary exceptions to Avast to allow the game client to work. You can find a full list of exceptions at the following link:

    Answer Title: Firewall Troubleshooting - Exception List for Windows
    Answer Link: http://help.soe.com/app/answers/detail/a_id/37058

    If you have any additional questions in the mean time please feel free to open a support ticket with us so we can address them for you. Thank you for your patience.
  5. DownhillDino

    I'll look into that, thank you for the information SeanF.

    What else was I to say?
  6. Piestro Community Relations

    Hey folks,

    Just to keep you updated, we are working directly with Avast to get this false positive addressed. There is no problem with the file and we're doing everything we can to help Avast address the issue.

    Edit: Here's a list of common virus protection programs and their analysis of our file. This shows that it's an Avast issue.
  7. EmmeraldWeapon


    I'm not going to say you weren't infected.. but it wasn't planetside 2 that did it.
  8. Piestro Community Relations

    Here's a workaround for the moment, until Avast can make necessary changes:

    Avast users can change their heuristics settings from normal (default) to low in order to patch without any issues.

    In Avast 2013:
    1.Active Protection
    2.File system shield
    3.Settings
    4.Sensitivity

    In Avast 2012:
    1.Security (top tab)
    2.Antivirus (side tab)
    3.File System Shield
    4.Settings (button, above graph, right side)
    5.Sensitivity

    Thanks,
  9. mrSplendid

    I was able to update my client without virus alert. After a week I can't believe in it :)
  10. Thorvaldr


    Thanks for responding to this thread to help us understand what is being done.

    I'm sure you're aware this is a touchy subject for a lot of players. Sharing this information is much appreciated.
  11. Piestro Community Relations

    Security is very important, and we're happy that our community is mindful of it. :)
    • Up x 2
  12. Thorvaldr

    UPDATE:

    It looks like something was resolved. I just now successfully updated and launched the game without modifying anything on my Avast client.

    If you've had this issue over the past week, please try again and report your results (just in case I'm experiencing an anomaly).

    Either way, thank you Piestro & SeanF for keeping us posted.
  13. Xodd_1138

    I was also able to update without any chances to Avast. :) Thank you
  14. DukeFlash

    I have also updated without changing Avast in any way.
  15. NC_agent00kevin


    I do run Avast, however, all shield control was off when the file reported itself as being a virus.

    I think SOE is just pointing the finger at Avast! because they dont want to own up to some funky coding at very least. Avast! doesnt arbitraily pick files to flag; it does so because the file is written as such that it resembles malware. Perhaps there is something intrusive in SOE's code and Avast doesnt like it.

    Think about how many patches you've downloaded for not just PS2 (which are many) but for every other game you have.

    Now tell me how many false flags Avast has popped.

    Ill tell you how many in 5 years Ive used it: NONE. Not that its impossible, but I find it highly unlikely that SOE released a patch full of benevolent code that Avast decided it simply doesnt like. I find it highly likely that SOE has something a bit on the intrusive side that quite well resembles a trojan and Avast says 'WHOA BUDDY NOT HERE'.
    • Up x 1
  16. EmmeraldWeapon

    Oh please.... funky code? hahaha... So now your saying it isn't a virus, SoE just needs to program better code that does not trip up anti virus programs. Thats freaking hilarious, and shows just how little you know about how viruses and antivirus programs work,

    I actually see AV programs trip up a lot on programs that either a) internally compress their own code (Many viruses do this so its a favorite thing to scan for) and b) freeze or modify memory values in other programs, ie game trainers. It is rare, AV programs for the most part are very good about not generating false positives.. but they are called false positives because they do make them.
  17. Brainwayne

    its infected by some NSA virus :eek:

    :p
  18. Jakes

    Let me get this straight, you have the time to come post here and make fun of people who obviously have a deep knowledge of security issues while you are not experiencing any issues yet make fun of the aforementioned? It doesn't take a detective to figure out what you're up to.

    It would be interesting to find out why the virus in the latest patch tried to access my itype.exe keyboard process and dll's the day after it was detected and removed... this still remains unexplained and its quite obvious SOE will *never* admit to wrongdoing.

    As TSR Sean said: "PlanetSide 2 has no viruses associated with the client." -- This is technically correct, as the virus was in the patch file not the client.

    Unfortunately I will not be returning to PS2... in my 10+ years of gaming I have never had a game flagged as a virus or even a false positive.... ever, and PS2 has already triggered my anti-virus twice (which is not Avast).
  19. NC_agent00kevin



    I didnt say it wasnt a virus. Just because I put stuff in your mouth doesnt mean you can put worrds in mine. Thats not how this relationship works.

    You have just shown us all how little you yourself know about viruses and programming. Thank you for your ignorance.
    • Up x 1
  20. Jakes

    How about the unanswered question as to why my keyboard was attempting to be accessed a day after after deleting the *false-positive* patch virus, again upon computer boot-up without ever starting Planetside2.exe