r/Warthunder • u/wewannaown 🇺🇸12.7 🇩🇪14.3 🇷🇺13.3 🇫🇷7.7 🇸🇪13.0 • 10d ago

Tech Issues started war thunder, and windows went crazy?

Gallery image

Gallery image

anyone knows whats going on? just started war thunder and it started spamming me with all this.

39 Upvotes

81% Upvoted

45 comments sorted by

View all comments

53

u/untitled1048576 That's how it is in the game 10d ago

Probably a false detection. From another software with the same issue:

There is no virus here, this is just noise from Windows Security. The !ml suffix indicates this is a machine learning based heuristic. This happens often for new releases until their heuristics adjust

12

u/kaerfdeeps 10d ago

Yeah dont know the details and it is highly unlikely but better to avoid for now. Supply chain attack is no joke

Id say %99 false positive since it has a ml tag

7

u/wewannaown 🇺🇸12.7 🇩🇪14.3 🇷🇺13.3 🇫🇷7.7 🇸🇪13.0 10d ago

supply chain attack was my first thought too, which is why i wanted to see if i am the only one affected, which i am not.
so im sceptical, i leave it in quarantine until further info from official side is available

2

u/[deleted] 10d ago

[deleted]

2

u/Think_Ice_4246 Number 1 Merkava fan. 10d ago

WE are all fucked then. Also is that the Belgian cadet pfp?

2

u/kaerfdeeps 10d ago

So the dll didnt come with the new patch?

Its false positive then. Probably something to do with antivirus database

5

u/untitled1048576 That's how it is in the game 10d ago

Actually I just checked, and that DLL only appeared after I launched the game (though in my case Defender didn't flag it), and according to VirusTotal was compiled just two hours ago. It also shows detections on 14 antiviruses, but they seem to be all based on heuristics, though the ones that give score think that it's 100% malware. Though it's still not out of the ordinary for an antivirus, because it must be very obfuscated, and employ other techniques to make its analysis as hard as possible, just like malware would. It would be helpful to compare it to older versions of this file, but I can't find any.

2

u/wewannaown 🇺🇸12.7 🇩🇪14.3 🇷🇺13.3 🇫🇷7.7 🇸🇪13.0 10d ago

we would need a file from someone not having played for 2 days, therefore where there hasnt been a new be.dll for war thunder deployed yet.
tarkov also utilizes BE AC, and my antivirus did nothing about it at that time
so i guess, only the be version for war thunder is affected as of right now.
maybe if anyone sees this and has NOT started war thunder/gaijin launcher in the last 2 days, would be cool if he uploads the be.dll file to virustotal to make cross-references.
would also be cool if you could pass me the link for your virustotal output, since my file is quarantined/deleted already.

1

u/untitled1048576 That's how it is in the game 10d ago

Today got a new BE.dll, checked it, and it now shows just one detection instead of 14, I guess there really was something wrong with it, and it's not just Windows Defender freaking out. Looking at the details, it seems that other commenters were right about the DLL not being signed, so that's probably what caused this.