[Bug] My AV software is finding high-threat risks in ESO?

Sintao · August 2017

Windows 10 Professional 64 bit
No peer to peer, file-sharing or other risky endeavours (this is a work PC!)
AV = Norton Internet Security
Noting now this is probably not A Big Thing.
I note that a threat may or may not exist.
Still, posting here in case it is due to an intended action by ESO files.
The dll in question seems to be have created via JAVA (javaw.exe, used when you do not want a console window to appear).

Summary:
Filename: libcef.dll
Threat name: Heur.AdvML.CFull Path: s:\games\eso\launcher\libcef.dll
On computers as of 13/12/2016 at 11:30:29 PM
Last Used 9/08/2017 at 9:21:15 PM
Startup Item No
Launched No
Threat type: Heuristic Virus. Detection of a threat based on malware heuristics.
libcef.dll Threat name: Heur.AdvML.C

Many Users. Hundreds of thousands of users in the Norton Community have used this file.
Mature. This file was released 3 years 11 months ago.
High. This file risk is high.
Source: External Media
Source File: javaw.exe
File Created: libcef.dll
File Actions Infected file: s:\Games\ESO\Launcher\ libcef.dll Restart Required
File Thumbprint - SHA: 1a70fc720f0eec1ebd614cb2bf9036e454c77ea64ccd6d5a38b287193907f84d
File Thumbprint - MD5: a3d088bf242e4c8312813ec6f94bb1b9

xRIVALENx · August 2017

Head on over to Virus Total and submit the dll in question for analysis, more than likely a false positive.

SHADOW2KK · August 2017

I use Norton and never had issues with ESO, try setting an exception to it in Firewall, set to allow, auto might be tripping it.

Sintao · August 2017

Okay, I looked into this (deep dive) , and traced it back to (maybe) an AddOn. Reinstalling the AddOn corrected this. I also note libcef.dll is a Chromium Embedded DLL. The alert seems to be based on a Norton heuristic detection and as mentioned in my OP is likely no big deal.

Virus total sees it as clean. Most likely a false positive. I will begin a discussion on esoui for the AddOn is question.

Thanks for the feedback @SHADOW2KK and @xRIVALENx !

SHADOW2KK · August 2017

Sintao wrote: »

Okay, I looked into this (deep dive) , and traced it back to (maybe) an AddOn. Reinstalling the AddOn corrected this. I also note libcef.dll is a Chromium Embedded DLL. The alert seems to be based on a Norton heuristic detection and as mentioned in my OP is likely no big deal.

Virus total sees it as clean. Most likely a false positive. I will begin a discussion on esoui for the AddOn is question.

Thanks for the feedback @SHADOW2KK and @xRIVALENx !

Nice one, and your welcome:}