# Trojan horse virus found in SWL patch from Steam and during installation using install file from SWL website **URL:** \ **Category:** Support\ **Created:** [February 17, 2021, 3:10pm UTC](https://forums.funcom.com/t/trojan-horse-virus-found-in-swl-patch-from-steam-and-during-installation-using-install-file-from-swl-website/156537 "2021-02-17T15:10:35Z")\ **Posts on this page:** 14\ **Page:** 3
**Author:** ![tyrfing666](https://sea1.discourse-cdn.com/funcom/user_avatar/forums.funcom.com/tyrfing666/32/42108_2.png) [@tyrfing666](https://forums.funcom.com/u/tyrfing666)\ **Post date:** [February 23, 2021, 4:44pm UTC](https://forums.funcom.com/t/trojan-horse-virus-found-in-swl-patch-from-steam-and-during-installation-using-install-file-from-swl-website/156537/42 "2021-02-23T16:44:38Z")
Paranoid thought here - could your AV software be infected? Pretty unlikely - if it were, it would be getting you to replace Word or something popular I think. ---
**Author:** ![Csabz](https://avatars.discourse-cdn.com/v4/letter/c/e47c2d/32.png) [@Csabz](https://forums.funcom.com/u/Csabz)\ **Post date:** [February 23, 2021, 6:36pm UTC](https://forums.funcom.com/t/trojan-horse-virus-found-in-swl-patch-from-steam-and-during-installation-using-install-file-from-swl-website/156537/43 "2021-02-23T18:36:36Z")
yeah, no:D i dont think that would’ve happened without my notice since i bought a completely new machine and installed everything fresh and licensed, and i specifically keep an eye out for such things with the new machine…daily full timed scans etc…if i check on my old machine (a laptop from 2016) which i still have, its infested because that was like a machine which i didnt care about and installed everything without caring about the alerts…and that is where i started playing SWL as well ---
**Author:** ![Phase](https://avatars.discourse-cdn.com/v4/letter/p/a88e57/32.png) [@Phase](https://forums.funcom.com/u/Phase)\ **Post date:** [February 26, 2021, 12:46pm UTC](https://forums.funcom.com/t/trojan-horse-virus-found-in-swl-patch-from-steam-and-during-installation-using-install-file-from-swl-website/156537/44 "2021-02-26T12:46:48Z")
Right now it’s not failing at the game exe. It’s failing when updating the patcher (I was installing from scratch). Did you send in your patcher executable as well? ---
**Author:** ![AndyB](https://sea1.discourse-cdn.com/funcom/user_avatar/forums.funcom.com/andyb/32/79238_2.png) [@AndyB](https://forums.funcom.com/u/AndyB)\ **Post date:** [February 26, 2021, 2:57pm UTC](https://forums.funcom.com/t/trojan-horse-virus-found-in-swl-patch-from-steam-and-during-installation-using-install-file-from-swl-website/156537/45 "2021-02-26T14:57:43Z")
Pretty sure I did, but you can safely whitelist it at this point. Which specific .exe is it flagging? I can try that one again. ---
**Author:** ![Phase](https://avatars.discourse-cdn.com/v4/letter/p/a88e57/32.png) [@Phase](https://forums.funcom.com/u/Phase)\ **Post date:** [February 26, 2021, 4:25pm UTC](https://forums.funcom.com/t/trojan-horse-virus-found-in-swl-patch-from-steam-and-during-installation-using-install-file-from-swl-website/156537/46 "2021-02-26T16:25:05Z")
Secret World Legends\PatcherSetup.exe.tmp for Trojan:Win32/Emotet!ibt . Are you also sending in a “live version” (patched from running the actual install and patch process) or a locally built version? (I.e. the Version you are expecting to “send out”). If the latter, a compromise of the patch servers (as has been happening to others lately like Solar Winds or Nox) is not out of the question. That is why I don’t feel 100% fine whitelisting. (Also losing Lifetimer login bonuses until this is resolved ☹ ) ---
**Author:** ![AndyB](https://sea1.discourse-cdn.com/funcom/user_avatar/forums.funcom.com/andyb/32/79238_2.png) [@AndyB](https://forums.funcom.com/u/AndyB)\ **Post date:** [February 26, 2021, 5:35pm UTC](https://forums.funcom.com/t/trojan-horse-virus-found-in-swl-patch-from-steam-and-during-installation-using-install-file-from-swl-website/156537/47 "2021-02-26T17:35:31Z")
The versions I’ve sent are the plain clients, I don’t have some special version of the game at home. Is this the Steam version or our version? ---
**Author:** ![Phase](https://avatars.discourse-cdn.com/v4/letter/p/a88e57/32.png) [@Phase](https://forums.funcom.com/u/Phase)\ **Post date:** [February 26, 2021, 6:11pm UTC](https://forums.funcom.com/t/trojan-horse-virus-found-in-swl-patch-from-steam-and-during-installation-using-install-file-from-swl-website/156537/48 "2021-02-26T18:11:36Z")
This is your version. Fresh install, when the patcher tries to update itself the first time. I just received new Defender stuffs and tried it again with the same result. Please note it’s not PatcherSetup.exe at the point it gets Quarantained, it’s PatcherSetup.exe.tmp. Also, to reply to “I don’t have some special version of the game at home”, what I meant was that if the programmer handed you the version to pass on to microsoft directly it could be maliciously changed once it’s gone through the patch process, and not that you got the version from installing the game normally. Since you wrote “at home” I’m assuming you’re sending on the Version that you get from normally installing and patching the game and not the exe itself that is put into your patch infrastructure which is the ideal way to do it. ---
**Author:** ![krumpf](https://sea1.discourse-cdn.com/funcom/user_avatar/forums.funcom.com/krumpf/32/72216_2.png) [@krumpf](https://forums.funcom.com/u/krumpf)\ **Post date:** [February 26, 2021, 8:07pm UTC](https://forums.funcom.com/t/trojan-horse-virus-found-in-swl-patch-from-steam-and-during-installation-using-install-file-from-swl-website/156537/49 "2021-02-26T20:07:06Z")
Guy using Linux reading this thread ![tenor](https://global.discourse-cdn.com/funcom/original/3X/c/4/c47e7458e8f91bdf08de4473839f5c90b5c52fe1.gif) ---
**Author:** ![AndyB](https://sea1.discourse-cdn.com/funcom/user_avatar/forums.funcom.com/andyb/32/79238_2.png) [@AndyB](https://forums.funcom.com/u/AndyB)\ **Post date:** [February 26, 2021, 9:20pm UTC](https://forums.funcom.com/t/trojan-horse-virus-found-in-swl-patch-from-steam-and-during-installation-using-install-file-from-swl-website/156537/50 "2021-02-26T21:20:56Z")
I can’t seem to reproduce the issue with the specific temp file cited; are you able to DM me and send me the file in question if possible? Either in a dropbox or google drive link or anything like that is fine. edit: got a copy ---
**Author:** ![AndyB](https://sea1.discourse-cdn.com/funcom/user_avatar/forums.funcom.com/andyb/32/79238_2.png) [@AndyB](https://forums.funcom.com/u/AndyB)\ **Post date:** [February 26, 2021, 9:40pm UTC](https://forums.funcom.com/t/trojan-horse-virus-found-in-swl-patch-from-steam-and-during-installation-using-install-file-from-swl-website/156537/51 "2021-02-26T21:40:58Z")
> [@Csabz](#): > > Can you please maybe have them check again and come back with a confirmation and case number where it was confirmed? This is the base Funcom client (not Steam) from last week: ![image](https://global.discourse-cdn.com/funcom/original/3X/5/3/53be1a761367b42b6c4ed8546969c84244be1ccb.png) Now, the .tmp file appears to be different from the actual .exe, it looks like WD is flagging the temp file before the .exe is actually created as something and quarantining it (if you’re updating from an older version, for example). Also just to be sure, I rescanned the file just now on the Microsoft submission page: ![image](https://global.discourse-cdn.com/funcom/original/3X/b/4/b497cd62e72bcb09b0a86d6752c7cd618c799fd7.png) So if I can get a copy of the _temp_ file maybe that will help? edit: got a copy ---
**Author:** ![AndyB](https://sea1.discourse-cdn.com/funcom/user_avatar/forums.funcom.com/andyb/32/79238_2.png) [@AndyB](https://forums.funcom.com/u/AndyB)\ **Post date:** [February 26, 2021, 10:43pm UTC](https://forums.funcom.com/t/trojan-horse-virus-found-in-swl-patch-from-steam-and-during-installation-using-install-file-from-swl-website/156537/52 "2021-02-26T22:43:35Z")
I got a copy of the .tmp file and submitted it. Hopefully we get a response soon! edit: ![image](https://global.discourse-cdn.com/funcom/original/3X/e/c/ec538f46aa3af8289884ec27e2fcbda474ea88a4.png) 🤷‍♂️ Initial scan shows nothing. Maybe an analyst will find something more. Virustotal also shows the file is completely clean. ---
**Author:** ![AndyB](https://sea1.discourse-cdn.com/funcom/user_avatar/forums.funcom.com/andyb/32/79238_2.png) [@AndyB](https://forums.funcom.com/u/AndyB)\ **Post date:** [February 27, 2021, 3:10am UTC](https://forums.funcom.com/t/trojan-horse-virus-found-in-swl-patch-from-steam-and-during-installation-using-install-file-from-swl-website/156537/53 "2021-02-27T03:10:48Z")
![Screenshot_20210226-220818~2](https://global.discourse-cdn.com/funcom/original/3X/f/4/f43aa7cf26580b0d41a37034ae8110404b1f2cda.png) Should be good, hopefully! ---
**Author:** ![Phase](https://avatars.discourse-cdn.com/v4/letter/p/a88e57/32.png) [@Phase](https://forums.funcom.com/u/Phase)\ **Post date:** [February 27, 2021, 1:26pm UTC](https://forums.funcom.com/t/trojan-horse-virus-found-in-swl-patch-from-steam-and-during-installation-using-install-file-from-swl-website/156537/54 "2021-02-27T13:26:05Z")
Patching the patcher now worked, thank you. Hopefully the rest of the install will now go smoothly! 🙂 Edit: Install worked without further issues. ---
**Author:** ![system](https://global.discourse-cdn.com/funcom/original/1X/8d85ca8a66fb78fa7574e255b50aa722d634177b.png) [@system](https://forums.funcom.com/u/system)\ **Post date:** [March 6, 2021, 3:26pm UTC](https://forums.funcom.com/t/trojan-horse-virus-found-in-swl-patch-from-steam-and-during-installation-using-install-file-from-swl-website/156537/55 "2021-03-06T15:26:34Z")
Closed on March 6, 2021, 3:26pm UTC This topic was automatically closed 7 days after the last reply. New replies are no longer allowed. [Previous page](https://forums.funcom.com/t/trojan-horse-virus-found-in-swl-patch-from-steam-and-during-installation-using-install-file-from-swl-website/156537.md?page=2)