Ember Online Launcher - Giving False Positive

[Valleriani]

Hello, 

A user has reported that the Game Launcher that updates/installs the game.

 

He calmed the only thing he saw in the log was:

***** [ Files ] *****
File Found: C:\EO\launcher.exe

The launcher has been attached. It is a false positive though, the launcher was created by me and is safe. It installs the game Ember Online.

Launcher.zip

[thisisu]

Hi and welcome to the forums

I'm moving this topic to the appropriate subsection as MBAM isn't detecting this file (FDF925E61485C2CF9F2E88BD36D147B6).

Regards

[jboursier]

Hello,

It's fixed in the coming database update (published in a few minutes).

Sorry for the inconvenience,

[Valleriani]

Hello.

I didn't want to make a new topic, but seems like every time I update the client it seems to get a warning. I don't have issues with other viral programs so I'm not 100% sure what is causing it. I assume it's because it downloads the files (auto updater tool/etc) though.

I have included the launcher and the exe it downloads (Though it will download a zip package.)

 

Thanks!

Ember Online.zip

[jboursier]

Hello,

@Valleriani: Thanks! I'm taking a look at it soon. In the meantime, can you share AdwCleaner logfile showing your problem?

Thanks,

 

[JMueller88]

Automated Cleanup Engine
Starting Cleanup at 24/09/2013 - 04:56:26 GMT

Starting Routine> Removing c:\users\jordan\downloads\unzipexpresssetup.exe...#(PX5: BAF03C0A808441C90B090CA66FB8EB001C74ED2F - MD5: 744B2E95D516D2A6FA6642839AE0E1C5)...
Deleting File> c:\users\jordan\downloads\unzipexpresssetup.exe

Automated Cleanup Engine
Starting Cleanup at 24/09/2013 - 06:23:20 GMT

Starting Routine> Removing c:\users\jordan\downloads\abiword_installer_d154722.exe...#(PX5: 60EA979C504C3C0E1C921D98FBEC32001F2300AF - MD5: 530B06D4C80A9A28C95D08574E698001)...

Automated Cleanup Engine
Starting Cleanup at 24/09/2013 - 06:23:20 GMT

Starting Routine> Removing c:\users\jordan\downloads\abiword_installer_d154722.exe...#(PX5: 60EA979C504C3C0E1C921D98FBEC32001F2300AF - MD5: 530B06D4C80A9A28C95D08574E698001)...
Deleting File> c:\users\jordan\downloads\abiword_installer_d154722.exe
Deleting File> c:\users\jordan\downloads\abiword_installer_d154722.exe
Deleting File> C:\Program Files (x86)\Common Files\wruninstall.exe
Deleting File> C:\windows\TEMP\COMPPEFAC.dism.log.bak
Deleting File> C:\windows\TEMP\DMIA6D9.tmp
Deleting File> C:\windows\TEMP\DMIACA4.tmp
Deleting File> C:\windows\TEMP\DMIAD60.tmp
Deleting File> C:\windows\TEMP\DMIADCE.tmp
Deleting File> C:\windows\TEMP\DMIAE3C.tmp
Deleting File> C:\windows\TEMP\DMIAEE9.tmp
Deleting File> C:\windows\TEMP\DMIAF47.tmp
Deleting File> C:\windows\TEMP\DTXLST.txt
Deleting File> C:\windows\TEMP\fwtsqmfile00.sqm
Deleting File> C:\windows\TEMP\fwtsqmfile01.sqm
Deleting File> C:\windows\TEMP\gpatch_bby.txt
Deleting File> C:\windows\TEMP\Microsoft .NET Framework 4 Client Profile Setup_20130526_231023935.html
Deleting File> C:\windows\TEMP\schtask.txt
Deleting File> C:\windows\TEMP\SetOnlineURL.txt
Deleting File> C:\windows\TEMP\UDD5253.tmp
Deleting File> C:\windows\TEMP\UDD5256.tmp
Deleting File> C:\Users\Jordan\AppData\Local\Temp\C503.tmp
Deleting File> C:\Users\Jordan\AppData\Local\Temp\cancel.png
Deleting File> C:\Users\Jordan\AppData\Local\Temp\CD2F.tmp
Deleting File> C:\Users\Jordan\AppData\Local\Temp\etilqs_hgXa7MVOaoNoqO9
Deleting File> C:\Users\Jordan\AppData\Local\Temp\etilqs_jZKqkOoMaQJUh7U
Deleting File> C:\Users\Jordan\AppData\Local\Temp\IEC60F6.tmp
Deleting File> C:\Users\Jordan\AppData\Local\Temp\log.txt
Deleting File> C:\Users\Jordan\AppData\Local\Temp\Module9181.txt
Deleting File> C:\Users\Jordan\AppData\Local\Temp\next.png
Deleting File> C:\Users\Jordan\AppData\Local\Temp\offercast.exe
Deleting File> C:\Users\Jordan\AppData\Local\Temp\oovoosetup.msi
Deleting File> C:\Users\Jordan\AppData\Local\Temp\etilqs_hgXa7MVOaoNoqO9
Deleting File> C:\Users\Jordan\AppData\Local\Temp\etilqs_jZKqkOoMaQJUh7U
Deleting File> C:\Users\Jordan\AppData\Local\Temp\log.txt
 

I think thats the log that just deleted it.

[cocochepeau]

@JMueller88 Hello, this is not an AdwCleaner log (despite the fact that this is a 3 years old log..).