:Playonline\SquareEnix\FINAL FANTASY XI\ffxi.dll --- "Possible" Trojan.Gen.SMH.2

[Alhanelem]

Backing up, copying, deleting etc. your files doesn't break any rules.

[BobbinT]

normally, it's the AV software's responsibility to fix false positives, as the problem is not a defect in FFXI.

Maybe. But... if more that one AV reporting this, sometimes it's not always the issue with AV. SE himself might need to recheck their files. I mean, come on... Why AV never caught it before?

This once happened on my end before, re-compiling one of my office application DLL with new features that resulted office AV picking up trojan in it. Once I figure the cause and fix it (which was one of the unregistered library files), AV no longer reporting trojan from it.

[Fahzewn]

Hmm where would this file or folder for macro's, map markers be and would it go against SE's Policy agreement or copy rights even?

As long as you don't modify the files, it shouldn't really be against the ToS to copy, delete, move them.

Anyway, typically the character data is in the USER folder. Generally it follows the path of (The harddrive letter where you saved the game...default is normally C):/Program Files or Program Files X86/Playonline/FFXI/USER. While in the USER folder there should be X amount of additional folders. Each one of those represents each character you have created last I checked. I just went ahead and copied(DO NOT CUT, DELETE, OR OTHERWISE REMOVE THE FOLDER FROM FFXI) the entire USER folder then pasted it over to another location that I could find easily again. I re-installed the game, and then just dropped the USER folder back into the FFXI folder. So far I have not had any issues but I will admit that I didn't think to check map markers as while I do have them, I don't look at them often.

I'll end this post on this, if doing this and you have limited PC knowledge, 1) I suggest not to do it and suck it up losing the macros and such but mostly 2) Do not open or look at any of the files as if you do something in the files themselves, you could potentially make things worse. And again, I'm limited on working with moving around/reinstalling FFXI, so while there probably is a better way to do it. This way worked for me.

[Alhanelem]

Maybe. But... if more that one AV reporting this, sometimes it's not always the issue with AV. SE himself might need to recheck their files. I mean, come on... Why AV never caught it before?

This once happened on my end before, re-compiling one of my office application DLL with new features that resulted office AV picking up trojan in it. Once I figure the cause and fix it (which was one of the unregistered library files), AV no longer reporting trojan from it.

Right, but this isnt something that happened because of a change to ffxi.dll, as this just started happening out of the blue. If this started happening immediately after the dll was modified, a programmer creating a behavior that could be considered virus like by an AV software could be the cause. But that doesn't seem like it is the case this time.

[YosemiteYogorockBlondelle]

I keep wondering if the dev's, community team, and those who work on this game have even looked at either of the two threads that we all have been posting in or not but I kind of hope they just come up with a fix that doesn't require the annoying time and time again the full resinstall with this game,

I haven't seen any more follow ups on where there currently at and how they're coming along with this situation towards a resolve or if they just stopped and given up on it leaving it up to us..>.<;eek!

I'm really worried...yippie!...

[Fahzewn]

I keep wondering if the dev's, community team, and those who work on this game have even looked at either of the two threads that we all have been posting in or not but I kind of hope they just come up with a fix that doesn't require the annoying time and time again the full resinstall with this game,

I haven't seen any more follow ups on where there currently at and how they're coming along with this situation towards a resolve or if they just stopped and given up on it leaving it up to us..>.<;eek!

I'm really worried...yippie!...

http://www.playonline.com/ff11us/pol...ews23832.shtml

They already know and "supposedly" working on it. They mention the exclusion of the .dll file as a workaround.

[FrankReynolds]

Norton / Symantec make horrible AV software. At my old job, symantec end point protection randomly decided that a windows update file was a virus and bricked like 20 computers and servers by deleting parts of the operating system that were updated. According to their support forum, Trojan.Gen.Smh.2 is just a generic code for "We don't know what this is, but it looks dangerous". They have a method of flagging files where they flag something if it has the same file name as a file that has been installed safely on a large number of systems, but is in fact a different file. So bascially, your AV software went "woah, that doesn't look like the POL.exe that everyone else is running. That might have been tampered with."

TLDR; Symantec / Norton is horrible. It''s almost as bad as actually having a virus. Just mark the files / folders as safe and restore them from quarantine.

[YosemiteYogorockBlondelle]

http://www.playonline.com/ff11us/pol...ews23832.shtml

They already know and "supposedly" working on it. They mention the exclusion of the .dll file as a workaround.

Yes, I've seen those reports and even this be kind of pointless to say it now but.. I was hoping for even more updated news on it since then after there follow up message on the pol website which is what I was referring to in the first place. Anywho, I'm still having problems with windows 8.1 pro. restoring the file from Symantec/Norton's quarantined area well more like after the fact when I have done it, I understand its not just the symantec/norton company doing this to the ffxi gamer filers as well. Anyways, I will continue to watch the posts here in case anyone has any other ideas on the situation too.

Forgot to say thanks for trying to help out Fahzewn whatever I did, i'm succesfully back in the game now!

[oliveira]

Norton / Symantec make horrible AV software. At my old job, symantec end point protection randomly decided that a windows update file was a virus and bricked like 20 computers and servers by deleting parts of the operating system that were updated. According to their support forum, Trojan.Gen.Smh.2 is just a generic code for "We don't know what this is, but it looks dangerous". They have a method of flagging files where they flag something if it has the same file name as a file that has been installed safely on a large number of systems, but is in fact a different file. So bascially, your AV software went "woah, that doesn't look like the POL.exe that everyone else is running. That might have been tampered with."

TLDR; Symantec / Norton is horrible. It''s almost as bad as actually having a virus. Just mark the files / folders as safe and restore them from quarantine.

FFXI DLL is encrypted (for protecting the game against cheating and reverse engineering) and obviously it's updated every time the game gets updated. While that could trigger heuristics protections on AV software, that has never happened before.

I find amusing that only now AV software bugs out with FFXI updates. My theory is that some malware maker copied and started using SE's protection coding on their own malware and that caused this issue.

[Krashport]

This is getting old REAL fast... Waking up to this again, even after I did every measure to stop files from being removed. Starting to think maybe should just let this old game die with all the recent problems everyone been having.