Virus on FGII 3.1.3 : "CXweb/OddDld-A" ???

[Ricco]

Hello,

I tried to download the 3.1.3 update but my proxy server blocked the update. In my log file I found the file fantasygrounds.exe was infected by a virus : "CXweb/OddDld-A".

May be it's a false positive but I don't want to infect my system trying to solve the issue, someone as the same error on the update ?

Regards
Ricco

[Moon Wizard]

I haven't received any other reports of this.

Which security software application are you using?
Was this right after your update/install completed, or did it come later?

Thanks,
JPG

[Ricco]

Hi,

It's SOPHOS UTM an appliance I have before my machine to secure my network and system behind. The web proxy I used report this error so it never arrive to my machine. Don't want to risk it. :)

I read some false positive on SOPHOS anti-virus but not sure about this time.

Ricco

[ddavison]

Looking at the identification, that appears to be looking at web initiated downloads. While that might be unusual from most applications and something you'd want to block, it is a common feature for Fantasy Grounds and is necessary for it to work properly for updates and for sharing images, tokens, etc. If it also displays the URL and the url is pointed to either the fantasy grounds site or smiteworks.com sites, then you could submit it to Sophos for marking it as a false positive.

https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/CXweb~BadDlod-A/detailed-analysis.aspx

[Ricco]

thanks for the confirmation.

Regards
Ricco

[Ricco]

SOPHOS did an update to solve the issue.

May apologies about this freak alert, thanks for your fast reply.