Malwarebytes is picking up a exe as a trojan(the file itself is located in local\temp\gw2cache, can provide the whole number after that if it’s important).
Is this possibly a trojan or just a fake? I’m assuming it’s just fake, but it’s always good to know
If I can’t play Guild Wars 2 at work, I won’t work in Guild Wars 2 either.
Delayed content is eventually good. Rushed content is eternally bad. ~ Shigeru Miyamoto
My Malwarebytes is also suddenly detecting the awesomium process/file (which is the Trading Post) as a trojan. Never had this problem before. Has it suddenly been corrupted/hacked/something?
Ok, after doing some research at the Malwarebytes forums, it seems the ‘virus’ labeled TROJAN.AGENT is a false positive and Malwarebytes has said the will be adding it to their white list soon.
So, I guess it is ok…I’m not really all that virus/trojan tech savvy.
And thanx, I have a decent virus scanner, and malware scanner, else it would not have picked it up and quarantined it…lol.
Sadly, it does not seem possible to ask the Malwarebytes program to ignore it as it sits in temp.
Do not know if it matters but it says Trojan.Agent.DE. And thank you for your replies ~ I’m neither good with these things. However I do know that “get a decent virus scanner” can be discussed as when it comes to software or hardware a lot of people have different opinions whether something is good or not :P
I have found a workaround for this until Malwarebytes fixes their database.
With GW2 not running, temporarily turn of module protection in Malwarebytes. Start up GW2 and then the Trading Post. Minimize GW2 and start up module protection in Malwarebytes, again. Once the awesomium process is working, Malwarebytes will not turn it off. This is the only way I have found to be able to access the Trading Post while Malwarebytes has this database problem. I hope this is helpful to those with a Trading Post access problem. =)
awesomium_process.exe itself is a legit file that’s normally used by GW2 to display the gem store / trading post window. A new copy of this file is created when you start GW2 and it’s automatically deleted when you close the game.
Since I have Malwarebytes installed myself (though I only use it for on demand scans) I told it to scan the file and found that the latest version indeed labels awesomium_process.exe as a trojan.
I’m fairly certain it’s just a false positive, since the other malware scans label it as clean and it’s not even a persistent game file.
Most of the time when you get a false positive like this, it’s because either the file has a duplicate somewhere out there that does contain malware or the way the file operates just makes it look really similar to a known bit of malware – malware and virus scanners can’t always distinguish between the two, or they may simply adopt a “better safe than sorry” approach.
PS: if you do a scan you should be able to add the file to the ignore list by r-clicking on it and it will exempt it from future scans.
Sadly, right-click doesn’t work with Malwarebytes Pro, and the ‘add’ function does not, either (it being a temp file). Thus, the workaround I posted previously is your only choice at this time.
Sadly, right-click doesn’t work with Malwarebytes Pro, and the ‘add’ function does not, either (it being a temp file). Thus, the workaround I posted previously is your only choice at this time.
I got it to work ran scan in malwarebytes proafter scan at the botom right of mbams screen there is SHOW RESULTS button it shows the files it detected as malware you can right click there and add awsownium to the ignore list.
I did this with the game up and trading post up that way the file shows up
Never interrupt your enemy when he is making a mistake."
—Napoleon Bonaparte
Ahh…my Malwarebyte caught it through the Protection Module and not through the daily scan, so that must be the difference. Right-click does not seem to work from the quarantine area for me. I will run a quick scan, and see if I can add it that way. Thanks for the tip.
Ahh…my Malwarebyte caught it through the Protection Module and not through the daily scan, so that must be the difference. Right-click does not seem to work from the quarantine area for me. I will run a quick scan, and see if I can add it that way. Thanks for the tip.
let me know if it worked
Never interrupt your enemy when he is making a mistake."
—Napoleon Bonaparte
awesomium is the process GW2 uses to run the trading post interface, since the Tp seems to be on it’s own server. If you kill that process, your TP crashes. It’s also the reason lots of people have issues with the TP because windows likes to block that a lot without telling you. If you don’t believe me, open your Tp, then kill the process with task manager and watch your Tp crash
The false positive has been corrected in MBAM as of database version v.2013.04.23.07. If you are still having this problem, check for updates manually or wait for an auto-update if you have it enabled (auto-updates can take up to a day).
@Nate…yes, that worked after having to turn off Module Protection to allow the Trading Post to come up, then run the scan whilst it was active. I have no idea why you can’t right click when Malwarebytes quarantines processes through Protection mode.
@abased…that is great to hear! Though it is now on my ‘ignore’ list, and I think I will just leave it there, in case it should be deemed ‘dodgy’ again in the future. As to auto-updates, mine is set to check once an hour, so no waiting. =)
