Planetside.exe virus Win32: Hoblig [Heur]

Discussion in 'Player Support' started by Renegade, May 11, 2013.

  1. XLander

    I am not trying to spread paranoia I am trying to bring relevant information to the discussion. Just because your AV didn't catch this doesn't mean that AVAST is wrong. Now with that said the file is acting suspiciously. After deletion it multiplied to two files. After restart and boot scan it multiplied to near 7 files. So maybe they are wrong or maybe it is a virus.

    You need to understand that every AV is different each using their own heuristic methods to detect. Just because Avast noticed what others didn't doesn't mean they were FP. It only means that two bigger than me and more income/time to dispose of than me... both of which are being paid by me need to get together and find a solution.

    Don't put SOE on a pedastool. They have been compromised multiple times. They only tell us about the big ones that get them sued, or in the news.

    Just because you can't see beyond the horizon doesn't mean that the world is flat.
  2. XLander

    If this is not a FP it is serious and the fix is knowing how to replace the zero sector of your various hard drives, SSD's, flash drives, and floppy's. That will require knowing how to make or get a boot disc then digging up the process for overwriting your zero sector and hoping your HD/SSD/Et cetera takes and doesn't frag. So I think I would rather have a drive wiping than replace my many hundreds of dollars worth of SSD'd and HDD, and FD's. Just saying if this turns out to be a real virus I will expect restitution from SOE. No 15$ class action will do. I have 1k$ worth of drives roasting if this is actually that bug.What is worse is if this is that virus then I can't back up all my data because the infected drives will infect any new drive installed. So yes this is potentially way worse than HDD wipe of previous days. Its the loss of unattainable software with paying for it again and the loss of physical equipment.

    A lot of people say I am spreading paranoia but I am simply highly concerned, and see little open attention being given to keep us in the loop as to what is being done to fix it.

    I would like to know if there is anyone running XP using/having this issue. If so do us a favor and run a stream viewer and see if these target files are streaming data in the background. I would do it with mine but it wont install on 7.
  3. 6pecx

    simple solution uninstall current AV programs and install bitdefender problem solved as for (AVG, advast, kaspersy, Norton, eset, nod) they flag more false positives then flaging actual viruses.

    i have tried all av programs and nothing compares to bitdefender thats why i recommend it so if your worried about your safety from viruses get bitdefender
  4. Assassin22

    whatever im telling that its not a virus nor is it a problem it just a coding in the patch avast is saying that its a virus if your worried about go get or download a different AV until then wait for them to whitelist it
  5. XLander

    Its not in the test server. and not gone. More likely you added an exception.
  6. bwilson

    XLander what did Avast say? You contacted them as well right, or posted on their forums?
  7. aceoyame

    For the ones saying PS2 is infected. Are you sure you just aren't having OTHER things spread infection.

    By the way, why would I write a virus to trash someones MBR and then include a backdoor. That writeup makes no sense. Also take a look at the name, it is specifically stating heuristics caught it. Meaning at best it THINKS there might be a virus, not that there is.
    • Up x 1
  8. DownhillDino

    You are lucky then, it didn't spread.

    :rolleyes: Look, I'm familiar with viruses, this is obviously one. Some people didn't get it as others and especially I did. The computer that got the worst of it had over 20 files infected (continuously spreading as well!) and it prevented any browser from operating. And guess what? It was all traced back to Planetside 2, it was so obvious.

    You can keep saying that all you want. Apparently most people didn't get the bad side of it.

    Apologies if anyone may be offended by my aggressive tone, but it's inexcusable to say such things when something has clearly happened. The computers are clean but I refuse to download the update until there is an official fix for it. It's really a shame, I like playing Planetside 2.
  9. aceoyame

    So when did virus' get the ability to pick and choose which machine to infect?
  10. IDC_

    i would like to know what operationg system and antivirus you are using and if you got a warning/infection

    os: win xp
    av: avira antivir free
    warning: NO - not at patch download or playing after installing it

    today i installed MBAM and did a quick-scan and an additional scan of my ps2 folder - it found NOTHING

    but hey, maybe it only infects machines running windows vista and above
  11. aceoyame


    Or what is more likely (especially since XP is so broken I can't see anyone skipping that) is that PS2 isn't infecting but that they are getting infections or false positives from other places. But hey, they can all dig their heads in the sand.
  12. MorganM

    They don't "pick and choose" SOME spread wherever they can unless otherwise prevented or unable to. Others don't spread like that but that's not relivent here.

    I found this thread after I too had Avast tell me PS2 had infected files. Never had this problem before. Wasn't a problem until a recent patch. Nothing had changed on my end as far as Avast configuration or PS2 configuration.

    I'm not saying it's a virus or a false positive but it's awefully alarming that one day PS2 starts getting write access errors the day a patch is released and Avast starts quarentining PS2 files saying they are infected.

    This doesn't bode well for SoE to be frank. A lot of ppl will see "omg there's a virus!" and delete the game. Others will have the write access errors I had, can't fix it, and say "to hell with this, I can't fix it" and uninstall the game. Who is at fault is largely immaterial... people will simply associate a virus to this game and the damage to their image is already done.

    There's nothing in the game's install that tells me to add it to my antivirus exception list. I've NEVER had this issue with ANY other game; never had to add any game to any anti-virus exception list in 20 years. I'm quite savvy with computers and operating systems so I was able to figure out how to fix it but how many ppl are not and just frankly don't care enough? Why should they care? Why should it be so difficult for them to just get a free2play game to work properly?
    • Up x 2
  13. MorganM

    OS: Win7 Ultimate 64bit
    AV: Avast
    Warning: Eh?

    Here's what happend to me. The evening the last PS2 patch was released I opened up my launchpad. Download completed.... tried to install.... error was that PS2 didn't have access to write to the folder where ps2.exe was installed. I checked the folder and file permissions; everything looked good. Searched the web for the error I recieved... no real help there.

    Next day my scheduled virus scan came back with some alerts saying files were infected and quarintined. I saw it was all PS2 files. Huh... weird... Cleaned up all that, uninstalled PS2, reinstalled. Got the same write access permissions problem.

    Did a boot time scan... find the same files with the same virus... odd. Cleaned them up again, reinstalled PS2, same error.

    Disabled AV for 10 minutes, ran launch pad, patch was applied successfully, and game works fine.

    Re-ran boot time scan... same files... same virus. Found this thread.
  14. Jackal068

    I've been having the same problem with the Win32. Except out of the blue my computers performance has noticeably dropped since the first time Avast told me the PS2 file was infected. I've run numerous full system scans using Avast and the Microsoft Malicious Software Removal tool and only when i have the game installed do i get a Win32 warning. Now I'm torn. Reading the forums of people with the same problem and saying its just a false positive might be the reason PS2 is getting red flagged and its not really a virus, but how does that explain my computers drop in performance? Is it really a mistake or is there something else going on.... I cant tell.....
  15. NC_agent00kevin

    I was just told by the Planetside 2 launcher that it could not launch Planetside 2.exe - 225 because the file contains a virus.

    Not by Avast, but by the launcher itself.
  16. EmmeraldWeapon

    What is inexcusable is you insist on yelling "virus virus planetside gave me a virus" when i just showed you... PROOF... that it is not!


    Out of 46 antiviruses... ONE picked up a "it might be a virus" alert.
  17. EmmeraldWeapon


    Are you running avast? Avast will lock the file and the launcher could consider that as a sign an external program (like a virus) is trying to access and modify it.
  18. Jakes

    This is the second time in over a year that my anti-virus detected a virus, the last time a virus was detected was July of 2012 and surprisingly enough it was Planetside 2 as well (I still have a tech support ticket in for that event).

    While SOE may not be directly responsible two things must be understood:

    1) Sony's systems were comprimised a year ago, and attackers may have left a backdoor for future entry that has gone undetected. This in turn could have allowed them access to the developer machines and ability to insert more malicious code into the patch files that were to be distributed. In this scenario it is highly likely SOE was able to isolate the patch machine and remove this issue before it spread to more computers leaving the majority of players unaffected but severely damaging a few players computers who were the first to download the patch. If this situation is what occured we will not hear an official response from Sony as legal counsel would advise against making a statement to avoid another class action lawsuit and potential charges from the state for distributing malicious software.

    2) Regardless of how this situation occured SOE will not take responsibility for it. Whether it be a rogue employee who was recently laid off or North Korea's 1337 super hackers we should not expect any answer from SOE as this would allude to their guilt in the matter. Example; If SOE were to release a file or future patch that would include some form of virus removal, or if this virus were to infect the MBR, SOE would need to release directions on how to remove it. Both scenarios would be able to be turned around against the company in a courtroom in a class action lawsuit, and I am sure there are a few players of PS2 that are class action attorneys and would be itching at the chance to put a case like this under their belt.

    What do we do as players in this situation?

    First things first, if you're really worried about the security of your computer or network, or have sensitive data that cannot be comprimised your best bet is to buy a new hard drive and fry your old one.

    Secondly players can band to together and boycott the use or purchase of SOE games and station cash. While this may only be a minority of players it is the only way to gain the attention of a massive corporation, by denying them funds. However be aware that this action will not be looked upon kindly by SOE or forum trolls who will likely post right after reading this paragraph because it will make them madbro~

    Lastly players can chose not to care and continue playing the game under the premise that Sony would *never* distribute infected or malicious software in their code.
    • Up x 2
  19. bwilson

    False. Remove your network adapter and/or wireless adapter. If you are connected to a network you are vulnerable.

    I won't go into the reasons here, but a good read starts @ http://technet.microsoft.com/library/cc722487.aspx
  20. Jakes

    Oh yeah! I totally forgot when you unplug a network cable or wireless adapter viruses magically disappear off of the medium where they are stored, especially if they are in the master boot record... sheesh how could I forget this.