After the patch my Kaspersky Plus is accusing ESO64.exe of being a Trojan. anyone else having this?

RaikaNA · June 4

Event: Malicious object detected
Application: ESO
User: DESKTOP-73L625R\Raijin
User type: Initiator
Component: System Watcher
Result description: Detected
Type: Trojan
Name: PDM:Trojan.Win32.Bazon.a
Threat level: High
Object type: Process
Object path: C:\Program Files (x86)\Steam\steamapps\common\Zenimax Online\The Elder Scrolls Online\game\client
Object name: eso64.exe
Reason: Behavior analysis
Databases release date: Yesterday, 6/2/2024 5:22:00 PM
MD5: D0928B79E160A5BC8ECABFFD965765DD

Is anyone else having this problem with their anti-virus software?

Now I'm having issues starting up the game.

shinry · June 4

I am also having this issue. It opened up the first time after the update but it won't allow me to open ESO up again after the fact and I am not sure how to proceed.

RaikaNA · June 4

shinry wrote: »

I am also having this issue. It opened up the first time after the update but it won't allow me to open ESO up again after the fact and I am not sure how to proceed.

Same here. I could download the patch and everything and log in to the game soon after, but when I tried logging in for the second time, all hell broke loose. My anti virus software deleted the eso64.exe

shinry · June 4

I also don't see it in the folder even though I didn't let it "disinfect and restart the computer." I made an exception to run it in Kapersky and marked it as trusted and repaired ESO client in Steam but ESO still will not launch. Rip my core trials

RaikaNA · June 4

shinry wrote: »

I also don't see it in the folder even though I didn't let it "disinfect and restart the computer." I made an exception to run it in Kapersky and marked it as trusted and repaired ESO client in Steam but ESO still will not launch. Rip my core trials

Go to your launcher and try to repair your game... Hopefully, it will add ESO64 again.

shinry · June 4

I will try to repair again with Kapersky completely shut down.

shinry · June 4

Were you able to get yours running at all?

RaikaNA · June 4

shinry wrote: »

Were you able to get yours running at all?

I repaired my game and tried logging in... got the same message.. It looks like you need to disable Kaspersky until they fix this problem.

shinry · June 4

Yep it works after repaired with Kapersky disabled but doesn't feel too good.

LostScot · June 4

This is because ESO captures a list of running processes, and will exit the game if any of the executable names or checksums match an internal list.

Many security vendors will recognise this behaviour with heuristics scanning of an application's activities, and can potentially classify it as malicious. In Kaspersky's case they're taking the cautious stance.

Edit: The reason this is considered malicious behaviour is because it is a common tactic used in malware, identify any unwanted processes on the host machine that may identify it, and exit if they're running. ESO does it to identify potential cheating software (or Process Explorer, which is a harmless Task Manager replacement), which is obviously a good reason (to detect cheating software, not to detect Process Explorer) to have this behaviour.

TaSheen · June 4

Sounds like y'all need to get on Kaspersky.

shinry · June 4

Thanks for all the help and feedback!

FelisCatus · June 4

It's likely a false positive.

Sedare38 · June 4

Getting the same issue. Kaspersky deleted the ESO client. I can get the game to work if I stop protection which is stupid. ZOS, this worked last night without my AV thinking you're a virus.

RaikaNA · June 4

TaSheen wrote: »

Sounds like y'all need to get on Kaspersky.

Already making some noises on the kaspersky's forums.

https://forum.kaspersky.com/topic/kaspersky-plus-is-accusing-elder-scrolls-online-to-be-a-trojan-47962/

Zoye · June 4

Posting for a friend who also was having this issue (he doesn't have forum access) and seemed to make this work:

Instructions:

Repair ESO - but do not launch

Open Kaspersky Total Security > Settings > Threats and Exclusions
In "Threats and Exclusions "
Add the eso64.exe file to both trusted applications and exclusions

Attached images for:
Specify Trusted applications
Manage Exclusions

You should now be good to launch ESO again

Dagraenion · June 4

Zoye wrote: »

Posting for a friend who also was having this issue (he doesn't have forum access) and seemed to make this work:

Instructions:

Repair ESO - but do not launch

Open Kaspersky Total Security > Settings > Threats and Exclusions
In "Threats and Exclusions "
Add the eso64.exe file to both trusted applications and exclusions

Attached images for:
Specify Trusted applications
Manage Exclusions

You should now be good to launch ESO again

Thanks for this workaround! It works great! I hope Kaspersky will fix this to the point where we don't have to use this workaround anymore.

Imperial_Archmage · June 4

I have Kaspersky Plus and the menu looks completely different from what you are showing here. How do I disable it entirely, its clearly a false positive?

TaSheen · June 4

Imperial_Archmage wrote: »

I have Kaspersky Plus and the menu looks completely different from what you are showing here. How do I disable it entirely, its clearly a false positive?

You probably need to access Kaspersky on your machine, and search for "disable due to false positive". I really don't know, but that's as close as I can come. I don't use Kaspersky.

Heretus · June 4

Hello , had the very same issue, patch applied , kaspersky identified it as a virus.

All I did was to add the entire ESO folder to exceptions settings > manage threats and exceptions (or something alike in English) > +ADD , choose folder , chose the entire ESO folder.

Kaspersky asked me to confirm , I did , pressed play again and it was done with no issues, I did not even repair the game or anything.

You may wish to disable Kasperky protection all together, add the ESO folder to exceptions , restart your PC and repair the game

kynesgrove · June 4

RaikaNA wrote: »

Event: Malicious object detected
Application: ESO
User: DESKTOP-73L625R\Raijin
User type: Initiator
Component: System Watcher
Result description: Detected
Type: Trojan
Name: PDM:Trojan.Win32.Bazon.a
Threat level: High
Object type: Process
Object path: C:\Program Files (x86)\Steam\steamapps\common\Zenimax Online\The Elder Scrolls Online\game\client
Object name: eso64.exe
Reason: Behavior analysis
Databases release date: Yesterday, 6/2/2024 5:22:00 PM
MD5: D0928B79E160A5BC8ECABFFD965765DD

Is anyone else having this problem with their anti-virus software?

Now I'm having issues starting up the game.

This thread is a great heads-up for Kaspersky users, thank you!!

I would have logged in without a second thought, only to be massively frustrated.

RaikaNA · June 4

Imperial_Archmage wrote: »

I have Kaspersky Plus and the menu looks completely different from what you are showing here. How do I disable it entirely, its clearly a false positive?

I recently upgraded my software from Kaspersky Total Security to now Kaspersky Plus.

From home you will see this

Click on details

Or go to settings <security settings<

Scroll all the way down until you see this

Click on the Exclusions and actions on object detection and then click on manage exlusions

final part

I've added C:\Program Files (x86)\Steam\steamapps\common\Zenimax Online\The Elder Scrolls Online\game\client
to the Exclusions list.

This worked for me so I hope it does for you.

ZOS_Icy · June 4

Greetings,

This thread has been moved to the PC Technical Support section, as it is better suited there.

Thank you for your understanding.

Dagraenion · June 8

This issue has been resolved. You can now remove ESO from Exclusion and Trusted in Kaspersky, and you be able to play the game. Just make sure to update your Kaspersky first, then restart.

woe · June 11

You should honestly get rid of Kaspersky. They have leaked user information, have ties with Russia and flag too many false positives on normal programs. You should look at a site like AV-test and replace it with something else.

LostScot · June 12

woe wrote: »

You should honestly get rid of Kaspersky. They have leaked user information, have ties with Russia and flag too many false positives on normal programs. You should look at a site like AV-test and replace it with something else.

Yeah, the company sponsoring Ferrari is responsible for all the conspiracy theories you've listed... In another universe maybe.

Where are the <sarcasm> tags when I need them?

SeaGtGruff · June 12

LostScot wrote: »

woe wrote: »

You should honestly get rid of Kaspersky. They have leaked user information, have ties with Russia and flag too many false positives on normal programs. You should look at a site like AV-test and replace it with something else.

Yeah, the company sponsoring Ferrari is responsible for all the conspiracy theories you've listed... In another universe maybe.

Where are the <sarcasm> tags when I need them?

They're here: /s