I have been playing SWL via steam for the past 4 months at least, with no problems. This morning, Feb 17, 2021 I noticed that Steam would not let me play SWL and Windows Defender complained that the PatchClient.exe (not sure if exact file) had a virus.
So I uninstalled the Steam version and downloaded the install client from SWL website. Then during the install process Windows Defender again found a trojan horse and would not let me continue.
Is this being fixed? I don’t want to have to manually remove the trojan horse before installing, as I am afraid of missing some steps and letting the virus contaminate my system.
Is it definitely finding something in the installs, or is there a possibility it is elsewhere on your PC?
Did a few checks on my installs and can’t see a problem with the client(s). Patched and ran all of the clients first so I know that they are running on “latest”. Also downloaded most current signatures for my antivirus.
Scan of Standalone client directory with Kaspersky:
Scan of Steam client directory with Kaspersky:
Scan of Steam client directory on another PC with Defender:
Scan of Standalone client directory on yet another PC with Defender:
There are a few people noting that they have seen alerts from Defender, it’s being discussed on the official Discord server at the moment. No other antivirus seems to be seeing it, so it’s pretty likely it’s a false positive.
Wouldn’t be the first time that false positives have happened, with this or other games. Understandable to be cautious, though.
I started having this issue last night in connection with a Windows 10 update. I play SWL through Steam and Windows Defender detects a virus upon starting the game in SecretWorldLegendsDX11.exe, but MalwareBytes does not. It does seem like a false positive, but it would be nice to get some confirmation on this and to get it cleared up.
Like I noted above it’s most likely a false positive from WIndows Defender. From what I have been reading, people have noted the same issue on some other Steam Games in the last couple of days, so the common factor seems to be Defender and whatever MS coughed up in their last update.
I’ve scanned now with 3 AV products and found nothing untoward.
My previous post being marked as solution, I won’t edit it. I just wanted to add:
« The guy using Linux points out the solution to Windows users, oh the irony »
This seemed to work, until I rebooted my computer. The same problem then cropped up. Only way around it right now appears to be taking the steps outlined above at every startup or adding SecretWorldDX11.exe as an exception to Windows Defender. I really hope Funcom gets this cleared up.
ADDED IN EDIT: Just experienced the virus detection again after performing the signature update above. So it seems my only option is to add SecretWorldLegendsDX11.exe to the Windows Defender exception list. I hope Funcom works urgently with Microsoft to resolve this problem. Already there are negative reviews of the game appearing on Steam claiming the game contains a virus.
MS Agent 1: “There’s a guy on the phone that says our AV is destroying their game.”
MS Agent 2: “Is it a game that we make money from?”
MS Agent 1: “Nope.”
MS Agent 2: “Hang up , dude.”
Seriously though, like @krumpf of Linuxheim shares above, Microsoft already know that it’s a false positive. They’ve fixed it in “later” signature files, but the way those signatures get distributed is uneven at best.
The detection “issues” haven’t just affected SWL, either; I’ve seen chatter on a couple of other game forums, so whatever MS changed may be targeting a development framework or tool rather than something game specific…
If Funcom would officially acknowledge they are aware of the problem and working on it, that would go a long way towards satisfying customers experiencing this issue. It’s what reputable companies should do, and that’s not a lot to ask.
We are aware that Windows Defender appears to be flagging Secret World Legends as Malware, and appears to be exclusive to that particular antivirus program. We’ve submitted the game client to Microsoft for review on their end. In the meantime, some folks have reported success with updating their definitions.
I have the same issue.
reset and updated windows defender signatures and reinstalled SWL, still get Windows defenders flagging SWL as a serious Trojan.
When in the command prompt (Start Menu ->search for “Command” → Right click and “Run as Administrator”) type cd “C:\Program Files\Windows Defender” to be taken to that directory
Yeah, I get an error when I Run “MpCmdRun.exe -removedefinitions -dynamicsignatures” so I’ve just added the SWL folder as an exception on Windows Defender, works fine now… but hopefully a better solution will come along. The message I get is this:
Starting engine and signature roll back to last known good…Failed! Error 0x800106ba
Andy! Gamemaster Odoneptera! Hello. Greetings. Uhm, I have seen something in that fix: I read that a lot of times this WinDef issue on SWL chats. It’s nice it’s claimed the directory shall be changed, but 90-95% of SWL players don’t know how to code like we do. Please add a line like,
cd “C:\Program Files\Windows Defender”
Thank you.
[11:35] [General] [Krumpfyne]: i bet most people don’t read the “open as admin”
»
Uhm, I have seen something in that fix: I read that a lot of times this WinDef issue on SWL chats. It’s nice it’s claimed the directory shall be changed, but 90-95% of SWL players don’t know how to code like we do. Please add a line like,