Spyware

[Jessica]

My antivirus found an executable called Spyware.Password Stealer.Python.V in the marvelrivals/network_tools.exe folder, does anyone know what it is?

[Jessica]

(ง ͡ʘ ͜ʖ ͡ʘ)งBonesMcSpook a écrit :

Yeah, I feel a little obligated to try and explain to people a little bit of tech sometimes but if they're just going to troll I'm not going to respond anymore.

Troll? I'm asking questions about what happened and you're trying hard to say it didn't happen when I have all the proofs. From the beggining, you tried to say I was lying and I'm the one trolling? That's crazy lol

[(ง ͡ʘ ͜ʖ ͡ʘ)งBonesMcSpook]

You dont have proof what you're saying happened, you have a single dot on a board and aren't listening to someone who deals with stuff like this daily.

If google chrome gets viruses a lot, its not google chrome intentionally giving you viruses, its google chrome getting infected with viruses.

You dont know what you're talking about and you're evading the reasoning.

You have a virus. Its not the game. Yes, it would hide in your game folder trying to name itself something that looks like it belongs there. That makes perfect sense and you mocking that is laughable.
Good day.

[Jessica]

(ง ͡ʘ ͜ʖ ͡ʘ)งBonesMcSpook a écrit :

You dont have proof what you're saying happened, you have a single dot on a board and aren't listening to someone who deals with stuff like this daily.

If google chrome gets viruses a lot, its not google chrome intentionally giving you viruses, its google chrome getting infected with viruses.

You dont know what you're talking about and you're evading the reasoning.

You have a virus. Its not the game. Yes, it would hide in your game folder trying to name itself something that looks like it belongs there. That makes perfect sense and you mocking that is laughable.
Good day.

I literally posted the proof on reddit and gave you the link to it lol. Good luck with your IT career, bye

[(ง ͡ʘ ͜ʖ ͡ʘ)งBonesMcSpook]

You didnt post proof, you posted the file path and a message saying 1 thing.
You have NO idea how often I see red herrings like this and people distract me away from finding the actual causes of issues because they cant get over the one thing they read from a program that cant think critically or look outside of what its told to do.

Okay, I found it after the game finished updating.
This is a file not a folder.
This is also just running dxdiag.
I scanned it with the newest version of malwarebytes: https://i.imgur.com/BU8wJVS.png
You're pointing to a single dot on a board and telling me it draws a line.
You dont know what you're talking about and its embarrassing. I'm used to talking to clients who know nothing about technology talking to me like they know more than me.

"but the program said"
The program was either wrong or you just have a virus.
I cant tell you how many times people do this. You're not right and it doesn't matter how many times you self reference your single instance of something.

[Savestate]

If you upload that exe to virus total it does indeed show up as malicious by Malwarebytes and Acronis. According to Malwarebytes:

"Spyware.PasswordStealer is Malwarebytes’ generic detection name for applications that may run in the background and silently collect information about the system, connected users, and network activity."

Considering it's called network_tools.exe it's likely gathering info on network activity.

[Jessica]

Savestate a écrit :

If you upload that exe to virus total it does indeed show up as malicious by Malwarebytes and Acronis. According to Malwarebytes:

"Spyware.PasswordStealer is Malwarebytes’ generic detection name for applications that may run in the background and silently collect information about the system, connected users, and network activity."

Considering it's called network_tools.exe it's likely gathering info on network activity.

A guy from reddit said: "It's (probably) a false flag. It's detecting the file because it was written in Python.

Known issue with Malwarebytes (other posts like this exist online if you look up Spyware.PasswordStealer.Python)

VirusTotal also only has Malwarebytes, Elastic, and SecureAge as detecting it as malicious, likely for the same reason. VT does detect a couple things that could be suspicious:

*The app being able to sideload Python DLL files

*The Python script maybe being bundled with Py2Exe, which is a tool that converts Python files into .exe files, which is very likely what MWB is pinging for, since this file likely was converted to an exe.

There's another file written in the same language, has the same program icon, and with the same digital signature: "client_diagnose.exe". And this file has been in the game since before this update. SecureAge flags it as malicious, but VirusTotal doesn't notice anything weird with it"

[Devon Lionheart]

Hey guys im farting in game as loki loki is farting guys hes farrting

[Midnight Aurais]

lol if you actually read the virustotal report it detects python side loading and image loading outside the python core

would be real hard if developers are not allowed to side load or at least load images

there is nothing weird going on other then it reading a windows search file and opening a yourphone file probably to integrate features but never ever going to connect my phone wirelessly to the pc and even then not this pc got a offline one

as far as i am aware the file just has developer shenanigans on it

[tanpopo ♡]

I'm using Malwarebytes and it also flagged network_tools.exe with the same warning as yourself. It's pretty likely to be a false positive.

[Jessica]

Midnight Aurais a écrit :

lol if you actually read the virustotal report it detects python side loading and image loading outside the python core

would be real hard if developers are not allowed to side load or at least load images

there is nothing weird going on other then it reading a windows search file and opening a yourphone file probably to integrate features but never ever going to connect my phone wirelessly to the pc and even then not this pc got a offline one

as far as i am aware the file just has developer shenanigans on it

I didn't read it cuz malwarebytes deleted the file, so the first thing I thought was asking what it could be

[Tore]

Savestate a écrit :

If you upload that exe to virus total it does indeed show up as malicious by Malwarebytes and Acronis. According to Malwarebytes:

"Spyware.PasswordStealer is Malwarebytes’ generic detection name for applications that may run in the background and silently collect information about the system, connected users, and network activity."

Considering it's called network_tools.exe it's likely gathering info on network activity.

This makes the most sense as it runs an Anti-Cheat

[Jessica]

After all the comments, it's clear now that this is a false positive, thanks to everyone who responded

[Marble]

Jessica a écrit :

Roland's 2nd a écrit :

Your AV is faulty.
Windows Defender and Malwarebytes both report the game folder as clean.
I'd suggest ditching whatever trash AV you are using.

My AV is Malwarebytes lol

There's your issue, Third party anti virus softwares are virus's themselves.

Windows defender is the ONLY anti virus you need and it's built in. unless you're doing illegal ♥♥♥♥ or downloading sketchy ♥♥♥♥, you shouldn't have what equates to actual malware, pretending to do virus scans, and then giving you false positives in order to get you to spend money.

If this game had or has any type of password stealer like you're claiming, the internet would blow up about it and the studio would get blitzed straight into the ground. Being the most popular game on steam currently with near half a mill concurrent players, people would notice, and this game would tank.

If you paid for malwarebytes, you got scammed big time. You're an idiot for using MWB, and not just using windows defender.

[Kapusta]

Bro it's chinese game of course there gonna be spy virus.

[toruvinn]

Jessica a écrit :

My antivirus found an executable called Spyware.Password Stealer.Python.V in the marvelrivals/network_tools.exe folder, does anyone know what it is?

submit this to virustotal.com, this still may not be the "ultimate" answer but at least should tell you how many different AVs find something suspicious there. if it's majority then uh, that's not good.