Gameoverlay.dll virus?!

huldu · July 25, 2009, 4:52am

Okay, the AV has gone nuts most likely through the update released very recently.

It detects gameoverlay.dll as a virus(daisy). Gameoverlay.dll is used by steam (steampowered.com). Obviously something is not right since the file is perfectly fine.

Dennis2 · July 25, 2009, 6:10am

I have moved to the False Positive Board.

Could you please post what gameoverlay.dll was detect as.

You should find it in Antivirus/ View Antivirus Events.

Thank you
Dennis

Vaishnavik · July 25, 2009, 6:31am

Hi huldu,

Thanks for reporting.We will get back to you after analysis.

Regards,
Vaishnavi.V.K

SpunkWeasel · July 25, 2009, 6:42am

Also happening to me . . . the virus scaner also detected hl.exe as “daisy-2245@31700727” from TFC and datacache.dll as “daisy-2376@31976256”, also gameoverlayrenderer.dll as “daisy-2378@31976254”.

It stared with gameoverlayrenderer.dll.

Bracca · July 25, 2009, 9:02am

Same happened to me. Either something has gotten into the Steam servers or this is false positive. Anywho, i placed the file into the “vault”. Now i can’t open Steam at all. It also found the same virus from the temp folder on C: and at two system info folders on E: (Steam is also located on my E: instead of C. C has a lto less space than E :s)
Anywho, here is what comodo Internet Security has found with D+ on paranoid:

"E:\System Volume Information_restore{8EF7CAA3-03D3-432F-
95E3-397D556B9099}\RP225\A0024699.dl"l = Detected as “daisy-2378@31976254” Satus = Removed
(Detected this 2 times and removed)

“C:\Documents and Setting\Rahka\Local Settings\Temp{D3782066-A541-4F2C-A8F1-5ABC17DB6F09}{9DF0196F-B6B8-4C3A-8790-DE42AA530101}_IsRes.dll” = Detected as “daisy2247@31700714” Status = Removed
(Detected 2 times, Removed only 1 time)

“E:\Steam\GameOverlayRenderer.dll” Detected as “daisy-2378@31976254” Status = “Quarantine”
(Detected 5 times, quarantined successfully.)

A Virus or a false positive? Will Run Malwarebytes, Superanti, Avast! antivir and Ad-Aware just incase and Comodo antivirus check one more time.

OS: Windows XP Home-Edition with SP3 and all possible updates
Comodo Internet security virusscanner: Heuristic check High and background check oslt is realtime, everything checked when used and threats are said to be noticed vefore they can do damage to the system.

hansj68 · July 25, 2009, 12:11pm

Hello!

Commodo Updated the db this morning. After that we also see the Daisy alert in GameOverlayRenderer.dll when starting Steam.

This is not the first time Commodo can’t see the difference between a virus and a true call.

Seems to be a false alert but typically GameOverlayRenderer.dll is without signatures etc. Shame to the Steam develop team.

Commodo, please put some more tests into your software before releasing your updates. They cause a lot’s of trouble out here.

Br
hansj68

dbrooks787 · July 25, 2009, 5:55pm

I’'m also getting this potential false positive in two other files: rserver.exe & radmin.exe (Remote Adminiistrator server & viewer).

gmohan · July 26, 2009, 3:29pm

Hi,

Bracca post:5:

Same happened to me. Either something has gotten into the Steam servers or this is false positive. Anywho, i placed the file into the “vault”. Now i can’t open Steam at all. It also found the same virus from the temp folder on C: and at two system info folders on E: (Steam is also located on my E: instead of C. C has a lto less space than E :s)
Anywho, here is what comodo Internet Security has found with D+ on paranoid:

"E:\System Volume Information_restore{8EF7CAA3-03D3-432F-
95E3-397D556B9099}\RP225\A0024699.dl"l = Detected as “daisy-2378[at]31976254” Satus = Removed
(Detected this 2 times and removed)

“C:\Documents and Setting\Rahka\Local Settings\Temp{D3782066-A541-4F2C-A8F1-5ABC17DB6F09}{9DF0196F-B6B8-4C3A-8790-DE42AA530101}_IsRes.dll” = Detected as “daisy2247[at]31700714” Status = Removed
(Detected 2 times, Removed only 1 time)

“E:\Steam\GameOverlayRenderer.dll” Detected as “daisy-2378[at]31976254” Status = “Quarantine”
(Detected 5 times, quarantined successfully.)

A Virus or a false positive? Will Run Malwarebytes, Superanti, Avast! antivir and Ad-Aware just incase and Comodo antivirus check one more time.

OS: Windows XP Home-Edition with SP3 and all possible updates
Comodo Internet security virusscanner: Heuristic check High and background check oslt is realtime, everything checked when used and threats are said to be noticed vefore they can do damage to the system.

We have fixed all mentioned FPs in DB 1773.
Please let us know if those are getting detected again.

Regards,
-Chandra Mohan