Recent Topics

Ads

Virus detected

Problems installing or downloading the game? Check the Install Guide first.
Forum rules
READ THE INSTALL GUIDE BEFORE YOU POST IN THIS SUBFORUM.

The stickies exist to handle common queries. Save our time and yours by reading them first.

Thank you.
thomasm15
Posts: 2

Virus detected

Post#1 » Wed Nov 17, 2021 8:48 pm

Hey there.
As I tried to download the launcher or torrent, or perhaps when I visited tixati as the same time, my defender told me a trojan had been discovered.

"trojan:script/phonzy. B!ml"

Is this normal or has anyone else had it before? I want to return to the game, but this scared me of. Or has it to do with surfing to tixati?

Ads
User avatar
wargrimnir
Head Game Master
Posts: 8280
Contact:

Re: Virus detected

Post#2 » Thu Nov 18, 2021 1:57 am

Tixati shouldn't flag anything, it's a safe site. Torrents don't flag anything either, they're just a pointer to the files that you want to download. The launcher can sometimes get flagged for some generic heuristic detection which your message is not at all general or heuristic.

I would be careful about whatever triggered that message. The launcher and our torrent don't contain anything that would trigger it.
Image
[email protected] for exploits and cheaters.
grimnir.me Some old WAR blog

thomasm15
Posts: 2

Re: Virus detected

Post#3 » Thu Nov 18, 2021 11:02 am

Thank you for replaying so quickly!
I did download three pdf's earlier the evening, but I would be surprised if these were the culprits as the virus detection came later.
In other words, I guess I can safely download both the torrent and launcher then. Windows defender removed the cache file that contained the virus.

User avatar
Lilim
Community Management
Posts: 1318

Re: Virus detected

Post#4 » Thu Nov 18, 2021 12:45 pm

Hey,

additional I want to add the little text that is added in our install guide:

Some Antivirus programs, Firewalls, Hardware Routers, and other security programs can be more aggressive than others, and in particular the RORLauncher has been flagged in the past. Partially because this is not a well known application in the wild, and partially because of how it works.
The Launcher manipulates objects in memory to make the game work with our server.
Some aggressive antiviruses automatically deem this to be virus-like behavior.
They check with their database of approved applications when they see this, and if they don't find our application in there, it gets a Generic flag and is sometimes blocked or damaged.

Because of this, we have to recommend that when you download with the Torrent, that you have your security disabled, and then whitelist the folder before turning it all back on.

We have repeatedly reached out to many AV companies and databases, many who responded accepted it as clean, and many others simply never responded leaving it with that Generic tag.

As you can see here VirusTotal (https://www.virustotal.com/gui/file/053 ... /detection) which is a very common database, is showing the launcher as clean in the vast majority of AV's. However, old definitions even from a company that doesn't have us flagged, can still cause problems.

Most people don't realize it, but Windows 10 has a built in anti-virus tool. You'll need to add your Warhammer folder to an exclusion list, or it might throw an error for the reasons above. This is a nice guide.
https://www.thewindowsclub.com/exclude- ... rity-scan/
If you have some other Antivirus blocking things, you'll need to figure that out with them, or just uninstall it.

TL;DR - The RORLauncher is safe. The torrent is safe. Please disable your AV BEFORE downloading, and whitelist the folder BEFORE turning it back on to prevent any potential issues.

User avatar
wargrimnir
Head Game Master
Posts: 8280
Contact:

Re: Virus detected

Post#5 » Thu Nov 18, 2021 2:00 pm

The latest version of the launcher actually has less detections than that one. Getting AV companies to whitelist stuff takes a while.

Down to only 4 detections now, and those companies have recent whitelist requests pending. One of them already added a whitelist to their database for it.

https://www.virustotal.com/gui/file/bb9 ... 1e4d2fa5d0
Image
[email protected] for exploits and cheaters.
grimnir.me Some old WAR blog

Who is online

Users browsing this forum: Ahrefs [Bot] and 20 guests