Sheur2.QLA Virus Found in Pirates Online (Merged)

[Ethan]

The Live Support guy told me that he logged the Problem for the Engineers to take a look at. But he has no answer. So I'm going to go talk to the AVG guys next.

[akamystic]

Hmmmm......well, did a full scan with McAfee.....no issues found. Both Open and Test run fine. When you do a Google search for SHeur2.QNR it only appears to pull references to AVG sites. Sounds like a case of mistaken identity on AVG falsely identifying a file....unless we truly have some users with a trojan.


http://www.avg.com/

Update AVG - AVI 270.10.23/ 1953

Added detection of new variant of Worm/Autoit.RQN, new variants of trojans PSW.Generic6.BDIY, SHeur2.QNR, Generic12.BPHA, PSW.Ldpinch.XAQ, PSW.OnlineGames.BPTA.

February 14, 2009

[Ethan]

Oh yea baby! I got the fix for AVG! I'll list the Steps you need to take to let it run Pirates.

Starting Out:

1. Open AVG to the System Overview.
2. Go to "Tools > Advanced Settings".
3. Look for "PUP Exceptions" and Open It.
4. Click "Add Exception". When it brings up the little box asking for the file path, enter "C:\Program Files\Disney\Disney Online\PiratesOnline\Launcher1.exe".
5. Let it register where the file is located, then click ok and apply.
6. Now stay in the Advanced settings menu and go to "Resident Shield > Exceptions"
7. Click "Add Path" and navigate it to "C:\Program Files\Disney\Disney Online\PiratesOnline\"
8. Click apply, and attempt to open Pirates Online! It should open up from your Desktop. If the desktop button does not work, go to, Start > All Programs > Disney Pirates Of The Caribbean > Pirates Of The Caribbean Online.

So there you have it. That's how you Configure AVG to Work with Pirates Online.

Sorry it took so long, but those Disney Live Support People are bad...

[Sven Niscadae]

Indeed. Sometimes the virus/malware scanner companies send out an update and it mistakenly tags a legit file as "harmful." I would not recommend running any additional anti-malware utilities for an issue like this since there wouldn't be any real results. You will either need to wait for AVG to fix it by sending out another update, configure AVG for an exception, or switch your anti-virus product.

edit: Well, there you go. Glad AVG was able to give you a solution (configure exceptions).

[Dr. Zeppers]

Well this bit me first thing this morning as well. Started using AVG when my nortons subscription expired. Thanks Ethan for doing the ground work here, was a life saver.

FYI If your on test, you'll probably want to add the TEST exe and Folder in the same fashion.

[blacky]

No i can't get this to work still. Wont let me do this part

Click "Add Exception". When it brings up the little box asking for the file path, enter "C:\Program Files\Disney\Disney Online\PiratesOnline\Launcher1.exe".

[Dr. Zeppers]

Originally Posted by blacky

No i can't get this to work still. Wont let me do this part

Click "Add Exception". When it brings up the little box asking for the file path, enter "C:\Program Files\Disney\Disney Online\PiratesOnline\Launcher1.exe".

If you are trying to type that in by hand that is likely the issue.
You should be searching for the exe itself with browse/search button (square with ... on it).
If the Launcher1.exe is not there, then its possible this has happened to you....

Originally Posted by Sinai

AVG goes ahead and deletes the file even when you tell it to ignore it.

This did not happen to me, I think AVG makes this decision based on the users level of access on the PC.
(Flat out said I was a power administrator on the screen that prompted me)

You may have to proceed to the AVG virus vault and see about recovering the Launcher1.exe file from it first.

[dangerousden]

I added the whole of the disneyonline folder to the AVG exceptions so I don't get a problem with the Test server launcher, which has also been flagged as sheur2 infected. I ran a full scan on my machine, and only launcher1.exe was found to be infected.

I think this is a repeat of last years problem. None of my spyware programs have found any other issues on my machine

[Luv2Travel1]

AVG updated their definitions yesterday, Feb 14th, and the old problem with the launcher.exe being a trojan horse is back. Same as what happened last year. There is no trojan horse, and no threat. It's just the same old AVP problem. I'm thinking of uninstalling AVP and finding another anti virus program if anyone has any suggestions, LMK. I agree with the PP who said that he wanted more control to decide weather to delete or ignore th problem, instead of AVP deciding for you.
Thanks!

[Andrew]

I got the same thing, here is a mini-screenshot of it:


All I can say for this is: If you're so sure its not really a virus, send it to Analaysis
Open AVG->History->Virus Vault
Click on the virus, and send it to analaysis, they can see if its really a virus or not.

EDIT:
I just tried to send it to analysis, 3 times, and it kept saying sending failed. Heres the screenshot:
(why is nothing showing, I really dont know)

[swashbuckler II]

So glad i dont use AVG think my laptop has it do, doesnt go pirates on it tho

[dangerousden]

The next update of AVG has cleared the problem.

Update your AVG manually and the problem disappears. And AVG don't even bother to apologise or mentionit as a mistake on their site

[Andrew]

I did the update, maybe im thinking of this wrong...but the virus is still in the virus vault...

[dangerousden]

If you restore the file, AVG fails to recognise it now.

[Andrew]

Awesome, thanks!