Wargaming.net Game Center application false positive

[alexwg]

Wargaming.net Game Center application is used for Wargaming.net games distribution. Executable file of this app - wgc.exe. It is signed by Wargaming.net certificate, but Malware Bytes Antivirus is blocked it as Malware. Please, assist, add wgc.exe to the whitelist to make the use of Wargaming.net Game Center possible.

The latest version of Wargaming.net Game Center installer is attached or can be found here: 

https://wds.gcdn.co/wgc/releases_tTrHgLCKHBRiaL/wgc_21.00.00.3580_eu/wargaming_game_center_install_eu.exe

 

Thank you in advance.

wargaming_game_center_install_eu.zip

Edited February 4, 2021 by AdvancedSetup
disabled live hyperlink

[Dashke]

Hello alexwg,

This is a legit detection as that IP is spreading Mozi linux malware.

Edited February 4, 2021 by Dashke

[alexwg]

Hi, Dashke! Thank you for your answer.

What server are you writing about? I'm Software Engineer in Wargaming.net and I know Wargaming.net Game Center application doesn't spread anything except of our games 🙂 We only use our CDNs and our own services.

[Porthos]

@alexwg

I assume during game-play, your app uses p2p technologies?

[alexwg]

@Porthos, we only use p2p to download 7z-archives with games binaries, for games binaries repair and for Microsoft Redists delivery. Game-play isn't related with p2p, other technologies are used.

[Porthos]

1 minute ago, alexwg said:

we only use p2p to download 7z-archives with games binaries, for games binaries repair and for Microsoft Redists delivery.

I am guessing the blocks are due to the p2p function and it due to the nature of p2p is reaching out/connecting to blocked IP addresses.

[Zynthesist]

Hello, both IPs you posted have very recent malicious activity. Domain you listed is not blocked by us. 

See here for details:

https://www.virustotal.com/gui/ip-address/125.63.70.222/relations

https://www.virustotal.com/gui/ip-address/42.61.99.155/relations

 

[RaidenKaminari]

178.175.75.244 and 62.84.68.204 were also blocked.

[ParanoiaBoy]

I've just gotten this same problem while downloading World of Tanks from the official Wargaming.net Game Center client described by OP.

I then decided to delete it and download the game through Steam, so the only thing I'm downloading is the game and I'm NOT setting up a torrent with malicious IPs.

what is "mozi linux malware"? is that the only thing those IPs spread?

[Porthos]

56 minutes ago, ParanoiaBoy said:

I'm NOT setting up a torrent with malicious IPs.

The Games use torrent tech to run the game.

As for why Malwarebytes blocks Steam, Epic and other games, this is because Steam is Torrent based software, are what are known as Peer-to-Peer (P2P) applications meaning it connects to many different servers/IP addresses (this is how files are downloaded through Torrent based software) and because of this, sometimes Torrent based software will connect to a server that is also known for hosting malicious content.  This is because servers/IP addresses are often shared by multiple sites, so while what you are Playing/downloading through Torrent based software may be perfectly safe, some of the sites hosted on some of the IP addresses that Torrent based software connects to may be malicious.  Such connections are not a threat however, and you may exclude Torrent based software from the Web Protection component in Malwarebytes to stop the blocks from happening without compromising your protection (your web browser and other critical web facing programs will still be fully protected from malicious websites and other malicious content).  To do so, add the game exe to your exclusions using the method described under the Exclude an Application that Connects to the Internet section of this support article.

[ParanoiaBoy]

to be more specific, I deleted the wargaming dedicated launcher that was using torrent tech, not Steam.

i switched TO steam to download that game because i hadn't got any issue with it. I mean, Steam was using torrent tech like 10 years ago, i remember not using it for years for this same reason. but i hadn't any issues for few years i started using it again (i don't know what changed), and i think it's safer than those dedicated launchers.

[Porthos]

6 minutes ago, ParanoiaBoy said:

Steam was using torrent tech like 10 years ago

Still does.

[ParanoiaBoy]

I'm not as tech savvy, i guess it still does but in a manner that doesn't trigger malwarebytes, i don't know...

[Porthos]

1 minute ago, ParanoiaBoy said:

i guess it still does but in a manner that doesn't trigger malwarebytes

"Steam" and other company's do not own or control the multiplayer servers and the IP's that are used so some times they are blocked.

[ParanoiaBoy]

got it

[Porthos]

1 minute ago, ParanoiaBoy said:

got it

You can always use play mode so the alerts will only show after you close the game.

 

•  

•  
• Quote

[AdvancedSetup]

I thought you removed, deleted this game center file?

Two of the IPs are still listed as malware

One was delisted

 

[BreadBoxDrum]

Got the same issue while downloading a new alpha test game from wargaming center today (06.04.2022). Got the first alert already on the installation of the launcher itself, than while download of the gamefiles and after finishing download again. 
IPs are visible in the screenshot. Thanks malwarebytes for saving me. But everything was downloaded as normal, high speed, installation of the game worked. guess it used only legit/unrecognised  server-ips than? 

[TeMerc]

On 2/4/2021 at 4:06 PM, Zynthesist said:

Hello, both IPs you posted have very recent malicious activity. Domain you listed is not blocked by us. 

See here for details:

https://www.virustotal.com/gui/ip-address/125.63.70.222/relations

https://www.virustotal.com/gui/ip-address/42.61.99.155/relations

 

Both these IPs are malicious, with one Mozi related and neither can be removed from the DB, add exclusions if needed.

VirusTotal - URL - 39a4b2af19aace0d5a01fa3c3d2c054d2bfbb0fabaa3f2fc9a0c7a757ca9b614

VirusTotal - URL - f350e861b6d33399974fd873987f300659433c6b66931a11ec2456a8564c860b