EVE Search - AntiVirus detecting RedistD3DXOnly.exe as a worm

Check My IP Information

All Channels

Issues, Workarounds & Localization

AntiVirus detecting RedistD3DXOnly.exe as a worm

» Click here to find additional results for this topic using Google

Monitor this thread via RSS [?]

Pages: 1 2 :: [one page]

Author	Thread Statistics \| Show CCP posts - 7 post(s)
pyklet uk1 UK1 Zero Red Moon Federation	Posted - 2007.09.25 07:29:00 - [1] Anti virus auto deletes this file as a worm rendering your eve client unable to connect ... So reinstall and guess what same again ! if i wish to play eve i have to turn off anti virus? Virus it detects is W32/Pwstealer.ODM
Marlko	Posted - 2007.09.25 07:32:00 - [2] I had the same problem this morning. It worked fine last night but this morning the problem occurred, I redownloaded and reinstalled and the same thing happened. I guess the the anti virus software updated this morning before I ran Eve. A fix that did not involve turnig my protection off would be helpful.
Lord Ragnet	Posted - 2007.09.25 08:08:00 - [3] help i have the same thing wot do i do
darkmyth	Posted - 2007.09.25 08:52:00 - [4] Edited by: darkmyth on 25/09/2007 08:54:35 me too, the same thing happend to me this morning. downloaded the client again and the same Virus was detected. then i tried it with the anti-virus off and still the same thing :( Now i cant play Eve
TA1PAN	Posted - 2007.09.25 09:02:00 - [5] same thing here
Kaori Riko	Posted - 2007.09.25 09:05:00 - [6] Same here. What virus checkers are people seeing this issue with? (assuming it is a false positive) IÆm seeing this with NTL (Virgin Media) PCGuard à yes IÆm a cheapskate lol and yes I now plan to go out and buy a proper AV packageà.
Jali Prince Minmatar	Posted - 2007.09.25 09:07:00 - [7] and me too!!! I use PCGUARD, from Virgin media, I have recently downloaded avg free, Im turning off the anti virus in pc guard and running with the avg to see if it works, oh and hey presto it does!!!! I also have been having a problem with another file, again PCguard kills it, AVG does not. M' Lord I would try the above, and dont forget to reinstall once you have disabled your virus program (INstall the AVG free one first!) Life is chocolate
darkmyth	Posted - 2007.09.25 09:10:00 - [8] lol im also using Pc guard from Virgin Media. Ok so my next thought is DELETE the damn thing lol
Eric Cire	Posted - 2007.09.25 09:11:00 - [9] Having the same issue here, and that's with F-Prot by Frisk Software. I'm guessing a new worm shares some common code with the eve file, and when everyones scanners updated with the new virus signatures, this all kicked off. I've managed to add an exclusion for just that file, and everything works well now.
Jali Prince Minmatar	Posted - 2007.09.25 09:30:00 - [10] PCGuard whilst being free isnt always fantastic, until 2 patches ago I was ok, now I have problems with it deleting eve files, stdlib.dll is another it wants to delete. so check your pc with another virus checker, hopefully it will be ok. Use that for a bit LORD RAGNET!!!! Love Jali Life is chocolate

The Padre Amarr Firing Blanks Inc	Posted - 2007.09.25 10:20:00 - [11] Aye I had this problem myself, gonna back up the file on CD and live with antivirus off while I am playing. _________

CCP Lingorm	Posted - 2007.09.25 10:40:00 - [12] So is it just F-Prot and PC-Guard that are causing this problem? The Redist file is a packaged redistribution of the Microsoft Installer for DirectX. Have any of you reported this false positive to the Anti-Virus company? That is the best way to get the problem solved. Most Anti-Virus packages also provide directory exclusion so that you can exclude the c:\Program Files\CCP directory until the fix is in. Running with NO AV is just to dangerous. I will pass this along to the GM's so that they are aware as well. CCP Lingorm CCP Quality Assurance QA Engineering Team Leader

Elgar Lightfoot Lightfoot Industries	Posted - 2007.09.25 10:55:00 - [13] I'm afraid PCGuard has no exclusion facility.
darkmyth	Posted - 2007.09.25 11:03:00 - [14] ive managed to get Eve back up and running again. I had to delete PC guard from my PC then i reinstalled McAfee Anti-virus.Once that was done i reinstalled Eve Client. now its fine :) Thanks to you all for your help
Jali Prince Minmatar	Posted - 2007.09.25 11:42:00 - [15] Glad you got it going again!!! Life is chocolate
Aypse D00M. Triumvirate.	Posted - 2007.09.25 12:42:00 - [16] I am having this same issue with iolo Antivirus. RedistD3DXOnly.exe infected with w32/Pwstealer.odm I also had the following 'virus': ccp\eve\lib\stdlib.ccp "Contains a destructive program" Originally by: Oveur Eve is primarily a PVP game and hence our focus is on making that experience balanced.
Jali Prince Minmatar	Posted - 2007.09.25 12:48:00 - [17] Edited by: Jali Prince on 25/09/2007 12:49:29 stdlib.dll here too! but as long as i said NO to delete it kept it. PCGUARD....tsk tsk Oh and I have emailed said VIrginmedia... Cant guarantee they will do anything but I did try! Life is chocolate
COUGAR ONE Caldari 2ND ARMORED CAVALRY REGIMENT	Posted - 2007.09.25 13:02:00 - [18] AT&T Internet Security Suite is also reading that file as being corrupt. I will try the disabling anti virus and see if that works. Good Stuff, For a while I thought someone was deliberatly attacking the Cougar so he couldnt log on to eve. lol " Charlie Mike"
Chicen Soup	Posted - 2007.09.25 15:00:00 - [19] same problem for me too, I use verizon security suite package.

CCP Lingorm	Posted - 2007.09.25 15:59:00 - [20] As this is affecting a larger number of our players than first thought I have logged support calls with Ioio, F-Prot and PCGuard. I can not log for the others as they are bundled software provided by ISP's and the ISP demand I be a customer before they will talk to me. If you are not using one of the above listed products and are suffering this issue then you will have to log a support call with them to advise them of the issue. I will keep you advised of any responses I get from the companies involved. CCP Lingorm CCP Quality Assurance QA Engineering Team Leader


HoIIy Smoke	Posted - 2007.09.25 17:15:00 - [21] installed eve after disabling pcguard.... seems to have worked... lets hope i didn't actually have the pwstealer malware that i was told was in C:\PROGRAM FILES\CCP\EVE\BIN\REDISTD3DXONLY.EXE
Molten Black Eve University Ivy League	Posted - 2007.09.25 17:50:00 - [22] Same,Same,Same. Virgin Media/PC guard.
Tharsgaard Caldari Fukd up Beyond all Reckognition	Posted - 2007.09.25 18:26:00 - [23] Originally by: CCP Lingorm As this is affecting a larger number of our players than first thought I have logged support calls with Ioio, F-Prot and PCGuard. I can not log for the others as they are bundled software provided by ISP's and the ISP demand I be a customer before they will talk to me. If you are not using one of the above listed products and are suffering this issue then you will have to log a support call with them to advise them of the issue. I will keep you advised of any responses I get from the companies involved. Have you checked that it is a false reading and these people arent infact infected with a password stealing virus? ---------------

CCP Lingorm	Posted - 2007.09.25 18:44:00 - [24] yes we have. One of the files is a Microsoft Redistribution ... and has been the same for a number of months, infact this started happening BEFORE the patch. So it is the new signatures from the involved companies that have caused this. Ioio have responded and are dealing with the Issue. Someone from Virgin media has contacted us to help with their product as well. So hopefully we should have a fast resolution on this. CCP Lingorm CCP Quality Assurance QA Engineering Team Leader

Orikon Maru	Posted - 2007.09.25 20:48:00 - [25] Verizon internet security suite has this problem as well.
Sleepkevert Paradox v2.0 Interstellar Alcohol Conglomerate	Posted - 2007.09.25 20:49:00 - [26] Originally by: CCP Lingorm I can not log for the others as they are bundled software provided by ISP's and the ISP demand I be a customer before they will talk to me. Bwahaha, gotta love costumer support Seriously tough, i'm not affected, but it's good to see such a fast response Sign my sig
Aypse D00M. Triumvirate.	Posted - 2007.09.25 20:59:00 - [27] Thank you CCP. Originally by: Oveur Eve is primarily a PVP game and hence our focus is on making that experience balanced.
Nef Erator	Posted - 2007.09.25 21:13:00 - [28] Hi. I've been having exact same problem. Virginmedia of course; though I'm using netguard rather than pcguard, they're essentially the same thing (they renamed it pcguard when virgin took over ntl, but those of us with netguard kept it). I've actually had a similar problem, with EVEmon a while back where the scanner insisted EVEmon contained a virus (turns out this was a known issue with EVEmon's installer, which most virus scanners seem to have fixed years ago). Thought I'd check here on the offchance it was a similar problem. Hope this gets sorted soon. Maybe it's time I got a better scanner :(
avelution Caldari Killjoy.	Posted - 2007.09.25 21:27:00 - [29] Same problem here, im using PC Guard as well... Until it has been fixed and to get around the problem I have unchecked the "Enable real-time virus protection" in the anti virus tab and then re-installed eve.

CCP Lingorm	Posted - 2007.09.25 21:51:00 - [30] Just heard back from one company and they have confirmed that there is no virus and will be putting an exclusion signature into their virus signatures to prevent this from happening. I am forwarding what they found to the other companies involved so that we can get a quick resolution. We are well aware that being connected to the internet and NOT having Anti-Virus is far to risky. CCP Lingorm CCP Quality Assurance QA Engineering Team Leader


Orikon Maru	Posted - 2007.09.25 22:56:00 - [31] Edited by: Orikon Maru on 25/09/2007 22:58:52 For other Verizon Internet Security Suite users: I spent quite a bit of time on the phone with a tech from Verizon. The VISS program does not have the option to exclude the file, so no luck there. As a work around I disabled the anti-virus portion of the VISS, left the other features running, and then downloaded the free version of AVG antivirus. I reinstalled the eve client and so far everything is running fine. Its not ideal, but its a way to keep some virus protection on the computer and still keep eve up and running. For those using other security programs, I strongly suggest something like AVG untill your regular security gets the issue solved. You just dont want to be running without some kind of virus protection.
MEDERAL	Posted - 2007.09.25 23:39:00 - [32] i got the same thing, it said it was not found or corrupt c:\programfiles\ccp\eve\bin\redistD3Dxonly.exenotfound was playing shut down then this happened will try the anti virus thing (big bummer)
Claudio Maximo	Posted - 2007.09.26 02:50:00 - [33] Edited by: Claudio Maximo on 26/09/2007 02:50:58 Same here, I was using FProt AV, so i uninstalled it, and got a 'security suite' from Road Runner.com, called CA Secrurity. And it works. So I don't leave my computer accessible to any 'virus'. See ya in EVE Space.
jdok Gallente The Burning Orphans Exuro Mortis	Posted - 2007.09.26 03:45:00 - [34] I live in ontario, canada, and use rogers internet, and they banned my connection today saying they found a virus. Of course it was at the exact time i fired up eve. When i told them about it the jockey on the phone couldnt do anything because its automatic. Now if i boot up eve again it'll alert their system and they'll ban my internet for a week. I dunno what to do but i am very sad.
Osco Caldari Fun Inc Knights Of Syndicate	Posted - 2007.09.26 04:04:00 - [35] Originally by: MEDERAL i got the same thing, it said it was not found or corrupt c:\programfiles\ccp\eve\bin\redistD3Dxonly.exenotfound was playing shut down then this happened will try the anti virus thing (big bummer) I got the same message, but I am using Command AntiVirus for Windows. It also "caught" and deleted the PWStealer.ODM earlier. Still can't load or play the game though.
HughJass	Posted - 2007.09.26 04:32:00 - [36] same here www.mytelus.net is isp http://www.freedom.net is antivirus bundled

CCP Lingorm	Posted - 2007.09.26 09:07:00 - [37] For all of you that have anti-virus software bundled from your ISP. Could you find out what the embedded product is please? That will allow us to go direct to the Vendor and thus when the new virus definition files are distributed the ISP's will get them and push them to you and the problem should go away. Please post here with the name of the ISP and the name of the embedded product. Ring the ISP and ask what the antivirus software is if you have too so that we can get this sorted asap. CCP Lingorm CCP Quality Assurance QA Engineering Team Leader

Elik Phossary	Posted - 2007.09.26 09:23:00 - [38] Can we download the redistd3dxonly.exe file from Microsoft so that we don't need to downlaod the whole Eve client?

CCP Lingorm	Posted - 2007.09.26 10:27:00 - [39] Edited by: CCP Lingorm on 26/09/2007 10:30:26 Edited by: CCP Lingorm on 26/09/2007 10:26:48 Unfortunately not as we digitally sign the file. We are uploading to our distribution servers and I will update this post with a link when we are done. EDIT : File CCP Lingorm CCP Quality Assurance QA Engineering Team Leader

Alaxen Caldari Confederation of Red Miners Red Moon Federation	Posted - 2007.09.26 11:02:00 - [40] Edited by: Alaxen on 26/09/2007 11:04:14 Originally by: Molten Black Same,Same,Same. Virgin Media/PC guard. It's easy enough to get around this. 1) Open up Virgin Broadband PCguard (it should be in your system tray) 2) Select Anti-Spyware 3) Select Quarantine 4) Select the redistd3dxonly.exe file and select 'Restore' 3) Up will pop a box saying "The selected spyware will be restored from quarantine. Do you want to continue?". 4) Make sure the box is ticked for "Trust the restored program in future scans." Select 'Yes'. 5) It restores the file. Then close the dialog. Easy peasy! Helps to know how your Anti-Spyware software works. --

Molten Black Eve University Ivy League	Posted - 2007.09.26 11:17:00 - [41] Originally by: Alaxen Edited by: Alaxen on 26/09/2007 11:04:14 Originally by: Molten Black Same,Same,Same. Virgin Media/PC guard. It's easy enough to get around this. 1) Open up Virgin Broadband PCguard (it should be in your system tray) 2) Select Anti-Spyware 3) Select Quarantine 4) Select the redistd3dxonly.exe file and select 'Restore' 3) Up will pop a box saying "The selected spyware will be restored from quarantine. Do you want to continue?". 4) Make sure the box is ticked for "Trust the restored program in future scans." Select 'Yes'. 5) It restores the file. Then close the dialog. Easy peasy! Helps to know how your Anti-Spyware software works. Thanks Alaxen. I shut down PC guard and ran AVG to play the game. Will give that a try later. thanks again.
Alaxen Caldari Confederation of Red Miners Red Moon Federation	Posted - 2007.09.26 11:49:00 - [42] Originally by: Molten Black EDIT: Just tried that. Nothing shows in antispyware Quarantine. The PWstealer shows up in the anivirus log to which there are no options other than clear log. My bad. Just done it again. It's the Anti-Virus quarantine where the file appears. Will edit earlier post accordingly! --
Osco Caldari Fun Inc Knights Of Syndicate	Posted - 2007.09.26 12:19:00 - [43] If anyone else is using Command AntiVirus for Windows, you can add the redistd3dxonly.exe file to the "files to exclude" list under preferences. Then download redistd3dxonly.exe from the above post and put it back in your bin file. Should work fine from there. Thanks for all the helpful posts guys!
Admiral FarCry	Posted - 2007.09.26 13:06:00 - [44] Neen help,i got AT&T internet security suite and it deletes my the same thing that the others are getting,how do i fix this with AT&T? havn't been able to play eve for 2 days now
Admiral FarCry	Posted - 2007.09.26 13:13:00 - [45] Originally by: CCP Lingorm For all of you that have anti-virus software bundled from your ISP. Could you find out what the embedded product is please? That will allow us to go direct to the Vendor and thus when the new virus definition files are distributed the ISP's will get them and push them to you and the problem should go away. Please post here with the name of the ISP and the name of the embedded product. Ring the ISP and ask what the antivirus software is if you have too so that we can get this sorted asap. Where do i find the embedded product and what exactly do you men by it,sry i'm not that inclined about stuff like this

CCP Lingorm	Posted - 2007.09.26 13:26:00 - [46] Have just heard from Frisk Software. They have updated the signatures for their AV software this morning and our files should no longer be flagged. Iolo have also responded quickly and should have new signature files out today as well. Virginmedia are looking into the problem and hope to have a fix soon. CCP Lingorm CCP Quality Assurance QA Engineering Team Leader

Lyra Mythrond	Posted - 2007.09.26 15:20:00 - [47] I use Command AntiVirus and i add the eve dir to the exclude list and now its working good ^^.
jdok Gallente The Burning Orphans Exuro Mortis	Posted - 2007.09.26 15:43:00 - [48] I don't know what my ISP, (rogers) uses, they allow you free mcafee anti virus access, but the file didn't even show up on there as a virus. They have some sort of system that looks for virus's comming out of user's networks, and they claimed I had some sort of backdoor virus launching attacks out to the internet through my network. I've checked all the comps on my network and they are clean, rogers hasn't shut down my net yet, so Its gotta be eve. They are a rediculously big company so I've tried to talk to someone important about it but i only get low level phone jockeys. The anti virus system on their network is all automatic so they keep telling me there is nothing they can do about it.
Molten Black Eve University Ivy League	Posted - 2007.09.26 16:03:00 - [49] I just manually downloaded the latest Virgin media/PC guard anti virus update. I am pleased to say Eve now runs with no issue. Thanks to CCP for contacting Virgin media and sorting this out. I cant help but think if this were EA or Sony we would be on our own. Hope others with different providers get the same results.
Orikon Maru	Posted - 2007.09.26 16:30:00 - [50] Originally by: CCP Lingorm For all of you that have anti-virus software bundled from your ISP. Could you find out what the embedded product is please? That will allow us to go direct to the Vendor and thus when the new virus definition files are distributed the ISP's will get them and push them to you and the problem should go away. Please post here with the name of the ISP and the name of the embedded product. Ring the ISP and ask what the antivirus software is if you have too so that we can get this sorted asap. I tried calling Verizon to get this information. I ended up speaking to a slow witted little troll with awful english skills. If I understood him, and I am not sure I did, I think he was claiming that Verizon developed the security software themselves, and that there was not an outside company involved. He gave me a phone number, 8775373380, for the department he said I should talk to, but when I was transfered I waited on hold for about half an hour, and eventually gave up. Lingorm if you want to give them a call they may be able to help, but packs snacks and a magazine, you may be on the phone for a while. I should note that this issue is only affecting people who are activly running the anti-virus portion of the Verizon security suite, which is a seperate pay security program they offer. Those using other security can still use Verizon to access the game. Im thinking of just droping their POS service and getting Norton back.

avelution Caldari Killjoy.	Posted - 2007.09.26 17:15:00 - [51] Yeah I have the latest update from Virgin Media/PC Guard and lookind good so far. Big thanks to CCP for helping as fast as you have.
Batar Fireheart Minmatar Stronghold corp Curse Alliance	Posted - 2007.09.26 20:09:00 - [52] Originally by: CCP Lingorm Have just heard from Frisk Software. They have updated the signatures for their AV software this morning and our files should no longer be flagged. Iolo have also responded quickly and should have new signature files out today as well. Virginmedia are looking into the problem and hope to have a fix soon. just posting to confirm. Yes they have f-prot no longer flags the eve client. "MAY YOUR WALLET BE FULL OF ISK AND YOUR CANNONS BLESSED"
jdok Gallente The Burning Orphans Exuro Mortis	Posted - 2007.09.26 20:43:00 - [53] hmm indeed a crazy coincidence, my roomate DID get a virus, but i logged into eve 1st and Rogers cut off my internet from that, as i logged in at noon and thats when they noticed the 'problem', and my roomate got the virus at 2pm. So its definately eve on rogers end, and apparently other rogers users are having the same problem. I've talked to a few tech guys but so far they have been ******** and nonhelpful "its done automatically, nothing we can do... don't know what scans we use, blah blah" Guess i'll keep tryin til I get a manager or something.
jdok Gallente The Burning Orphans Exuro Mortis	Posted - 2007.09.27 15:39:00 - [54] anyone have any luck with ROGERS internet yet? I'm still scared to fire up eve as i don't want them to ban my internet for a week.
gnarth	Posted - 2007.09.29 01:49:00 - [55] Heres one of the problem av contact details for you. Contact info for bellsouth users with at&t internet security suite. email here: http://help.bellsouth.net/bellsouth/asp/emailcontact.asp
gnarth	Posted - 2007.09.29 02:01:00 - [56] Just found this for at&t internet security suite users http://echat.bellsouth.net/sdcxuser/asp/frameset.asp This is a link to E-chat with an at&t agent should be faster than email at least
Lin Wui	Posted - 2007.10.02 00:51:00 - [57] This is appalling... If your antivirus does not provide a way to ignore a file/directory, replace it ASAP. Whoever created it has far too casual an understanding of security software for you to trust it on your computers. That feature is NOT optional. Neither is it optional for an antivirus vendor to provide the means to report a false positive. They must be out of their minds. Too many lawsuits have been filed by spyware companies for any serious vendor to ignore this. I've done consulting work for probably half the antispyware/virus companies in the US, two in Germany and one in Sweden. A sizeable percentage of updates to security software definitions manage to trip over something completely innocent, which they have to go back and fix in the next definitions. Seriously, if the exclusion feature was left out of whatever program you're using, nuke it. If they can't even get that right... If you're willing to spend money for the best, I recommend Nod32 If you don't want to buy a replacement, I recommend Avast
Falkrich Swifthand	Posted - 2007.10.02 10:27:00 - [58] Edited by: Falkrich Swifthand on 02/10/2007 10:33:01 I sincerely recommend "Avast!" antivirus as well. I was using AVG free edition before, and was getting annoyed at the fact that if you scanned something from the right click menu in explorer it couldn't do anything about any viruses it found (it quite literally JUST scanned). When I switched to Windows XP x64, I found that AVG hadn't made a compatible version yet. I looked at some comparisons, saw that not only was Avast home edition free, but had numerous 100% awards and had a x64 edition out, and haven't looked back since. In fact it's so good I recommend it to everyone I can. EDIT: Website: Avast! You have to register (free) to use the home version, and when the registration runs out in a year you can just register again (still free) as many times as you need to. It also runs without registering for 60 days as a demo, so you can try it out for a couple of months if you don't want to hand over your email address straight away.
Aaron Mirrorsaver R.E.C.O.N.	Posted - 2007.10.05 03:54:00 - [59] avast does in fact rule.. R.E.C.O.N. is recruiting


Pages: 1 2 :: [one page]

COPYRIGHT NOTICE
EVE Online, the EVE logo, EVE and all associated logos and designs are the intellectual property of CCP hf. All artwork, screenshots, characters, vehicles, storylines, world facts or other recognizable features of the intellectual property relating to these trademarks are likewise the intellectual property of CCP hf. EVE Online and the EVE logo are the registered trademarks of CCP hf. All rights are reserved worldwide. All other trademarks are the property of their respective owners. CCP hf. has granted permission to EVE-Search.com to use EVE Online and all associated logos and designs for promotional and information purposes on its website but does not endorse, and is not in any way affiliated with, EVE-Search.com. CCP is in no way responsible for the content on or functioning of this website, nor can it be liable for any damage arising from the use of this website.