Locked & Archived Critical Notice - Trojan Detected in Server 45.141.52.42:27015

[KniteRite]

Hello. I am new to reporting this kind of stuff, but I feel this is urgent. A Trojan Horse virus was detected on the server "45.141.52.42:27015" which is a UGC.TF Server, Specifically "2Fort+". 10+ Players were instantly disconnected from the server due to Anti-Virus Software. I would look into this IMMEDIETLY.

 

[Noctis]

It will be looked into ASAP

 

[Where]

Hello,
Please post all available info of the detection, ideally screenshots of the software that detected the issue
If more convenient, please feel free to start a private conversation with me on forums or join our discord and create an Other support ticket

There has been a case in the past where people were able to trick anti virus softwares with false detections via sprays that affected all of TF2, it is possible there is a new exploit related to false triggers

 

[KniteRite]

 

[Noctis]

View attachment 1855

What antivirus software?

 

[KniteRite]

What antivirus software?

Malwarebytes

 

[dedimark]

View attachment 1855

Report it to valve.

 

[Noctis]

The IP links to a Data Center/Web Hosting/Transit which Malwarebytes is known to flag as a Trojan/malicious. (Malwarebytes falsely flags hl2.exe as a trojan)

I do believe if it was a spray that caused this alert/trojan from Malwarebytes it should say

File:
E:\SteamLibrary\steamapps\common\Team Fortress 2\tf\download\user_custom/xxxxxxx.dat

So Im pretty certain it's a false positive. At most, you would need to report it to Malwarebytes so they can fix the false positive.

To block this alert from popping up, you would add your steam folder to the exception part in Malwarebytes.

We will keep an eye on this in case the exploit does come back but for now, I wouldn't worry too much about this

 

[dedimark]

View attachment 1855

172.234.120.150 - not ugc IP.

 

[Where]

With the above being said, I will close this thread as it is not related to a UGC operated server

Thank you for sharing your concern, we appreciate the heads up despite it not ending up related to us