AVG Identity Protection removing SimCity 4.exe as a threat

[Elitejohnson 1]

Sorry to bother you guys, but was greeted with this little gift whilst booting up today. I have spent some time going over everything and the rest of the system seems to be fine, but AVG first had a problem with ~e5d141.tmp which it informed me it had blocked last night as well as SimCity 4.exe (Going by the time it was as I was quitting the game and shuting down the PC so didn't notice it then, the game did seem like it had crashed when quitting.) Anyway it removed this, though it's connection to the game seemed very odd to me, after a couple scans all seemed right and I tried to see if the game still worked, and was then greeted with AVG blocking the game and requesting to move it the virus vault, which seems to be that both are false positives given the game has run with the current set up for some time, and nothing had really changed leading up to this point. The attached image is the information given on the exe in the virus vault along with the associated files it took with it. I haven't found much online, but have see some stuff about that particular tmp file method being used with a few programs including older Adobe products, and it corrupting causing similar problems.

 

Overall there does seem to be a fair amount pointing towards a false positive here, but basically I was hoping to see if anyone else in this great community had ever witnessed such an issue and could confirm the likelihood of it being a false positive? Otherwise I will just have to keep digging I suppose. The version of the game I was running is the original discs of the vanilla game and Rush Hour expansion, and the only change to the game before that particle instance of running was installing the Crane Collection by Bipin from here on the STEX (Apparently I had missed that dependency at some point.) If any of that helps.

 

I know this likely isn't really the kinda problem to be posted in this forum, but some of that brilliant knowledge contained from the regulars here might have the insight I need. Thank you for your time.

[VMIUJcadet09 250]

Hey Elitejohnson: This seems like a rather unusual incident and a one-off event. I don't know of any other member here that have had Simcity4 flagged by any AV as malware or a virus.

It may be that AVG has signatures identifying the game as malware for some unknown reason, or the game could have been bugged/compromised (see below line for more).

Another possibility is that some part of the game itself might have been hijacked by malicious code and embedded in the game's software, which may have been caused if you are actively connected to the internet at the same time you are playing Simcity.

All of the above are possibilities/theoretical and not necessarily what is going on with your game. I would highly recommend reaching out to NonnyMoose and other extremely knowledgeable computer professionals on here, they may be able to help you out too.

Also, for what it's worth, from what I know, AVG isn't necessary the best AV program out there...I know....your mileage may vary, but that's my understanding. I would recommend Kaspersky, Norton, Symantec, and BitDefender though.

Hope this helps!

 

You can also run your files in www.virustotal.com. It is a free website owned by Google that can determine if there is malware in those specific files/URLs you have visited.

[Elitejohnson 1]

Thanks for replying, yeah from my researching there didn't seem to be many cases of instances like this, though there are a few they tended to be that the individual had issues after the first install not so long down the line. The file was submitted to AVG and marked to be checked for a false positive, but yeah as you say AVG isn't great at all doubt to see anything be done about it. The only reason I still use it is due to the fact I am kind of between pc's, this laptop is well past it's prime but due to a number of family and financial hiccups over the last year I haven't been able to get my life sorted out to get my new PC at which point I wanted to go with kaspersky or the like (certainly not Norton though)

 

Anyway yeah I turned to virustotal as the first thing long before trying here, the other temp file mentioned by AVG was left intact and it was checked out as fine on there, though I haven't restored the two files from the vault yet and uploaded them to check, was hesitant to do so, though if they would seem like a good idea then that's what I will do. I was secretly hoping someone like Nonnymoose would show up, though I am sure someone like me is but a nuisance to someone of his calibre of knowledge.

 

Edit: VirusTotal found the tmp file to be perfectly fine, even had the maximum positive file rating, but it didn't like the SimCity 4.exe so much, my scan along with previous had 4 returns for being a possibly unwanted application. Shredded the game, going to see if it says the same for a new install, then take it from there really.

[A Nonny Moose 8,263]

Free AV programs are sometimes not the best way to go.  I've always used paid ones (McAfee) on Windows.  I've had no problems with CLAM-AV on Linux and it happens to be the default freebie.  You have to be very careful with free AV systems.  Sometimes they are actually malware.

[Elitejohnson 1]

Free AV programs are sometimes not the best way to go.  I've always used paid ones (McAfee) on Windows.  I've had no problems with CLAM-AV on Linux and it happens to be the default freebie.  You have to be very careful with free AV systems.  Sometimes they are actually malware.

Yeah as I said earlier I should have by this point been on a nice new desktop that I would have a nice paid for AV on, but at the time when this was supposed to only be around another month going out and spring out on a decent AV seemed a bad idea what with the costs of building the new PC and me not having an income, anyway long story short still stuck with this and keep planning on being rid of it with in each month, so never upgraded the AV software yet. I am not happy about having a free AV and things like this really tend to show their weakness, though I have used AVG free in the past and now for a while so I do feel fairly certain that in this case it is not malware(But I wouldn't say never unless it was a fully paid product from the manufacturer), and of course I would only every get it from the official site none of that downloading it from random download sites.

 

Anyway, going to try a re-install of the game to see what my AV and VirusTotal make or the newly installed file, then if it doesn't kick up a fuss about it, clean re-install of windows and start from scratch to be on the safe side.

[Nesral Sredna 62]

What version of AVG do you have? AVG Free edition 2014, or the paid AVG Internet sdecurity 2014? It's not an outdated 2013 or older, is it?

AVG is just fine for homecomputers, you don't need an entire suite to be safe, It will only slow your computer down, and you usually dont need the extra services they provide. http://www.howtogeek.com/137278/htg-explains-why-you-dont-need-a-full-internet-security-suite/ Norton was/is known to be especially slow and used to have a messy interface, be hard to un-install, flagging musicplayer Spotify as malware, etc. Norton has a high marketshare because it comes preinstalled on many computers, but it is usually the first to be uninstalled when the subscription runs out, and then people usually install either AVAST FREE edition or AVG FREE. AVG scores better than AVAST in the tests I've seen lately, and is not nagging you to buy the full suite either.Anyway, here is what I would like you to do:

1. Do an update of the latest virusdefinitions, and do run a complete virus check on the entire computer(all harddisks) in case there is more that AVG havent spotted yet...

2 Move your SC4 citiyfolder and the pluginsfolder to a backuplocation, and reinstall SC4 again..
 

 

Free AV programs are sometimes not the best way to go. You have to be very careful with free AV systems. Sometimes they are actually malware.

Scuse me, but that is just simple scaremongering. It doesn't matter if you subscribe to AVG Internet Security 2014, or use AVG free, it's the virus definitionlist that matters, wich is the exact same in both the free and the paid for applications, Not the extra goodies, wich you can get elswehere. As long as you use a well known AV, you're (mostly) safe, but it never hurts using the head either...

[Cyclone Boom 17,033]

Reminder note:

Discussing the best anti-virus (such as free vs paid suites) won't really help the issue described by the OP.

 

Let's keep this on topic.

 

Thanks.

[Elitejohnson 1]

Reminder note:

Discussing the best anti-virus (such as free vs paid suites) won't really help the issue described by the OP.

Quite right.

And to answer the previous post, yes I have up-to-date 2014 free AVG, and have run multiple scans, both on the SimCity folders and even more full computer scans, along with the daily scan nothing else has been found. Each scan has all the search for advanced threats and all that ticked, only thing I changed was for tracking cookies as I remove they regularly via chrome, so apart from putting that setting back on and removing the few left by IE, scans showing as clean as a whistle. After removing the file to check on Virus Total, scanning it again didn't trigger AVG, though I didn't risk running it before shredding it.

Currently installed the Deluxe edition from Steam, nothing from scans and AVG doesn't stop it launching. VirusTotal still has 2 of the 4 warnings present for it. Only got the base game installed off disc so far before I had to go, but again that runs with out AVG complaining, though this version has 3 of the 4 warnings from Virus Total. It certainly is looking a bit more false positive brought on by a crash causing it to misbehave. Still going to check the Rush Hour expansion and patch's cause the same original 4 warnings, and have a mate working for a decent corporate IT support company that has access to some better to scan the files to check too.

Hopefully all will work out good, but when no one else seemed to of had this before, I was incredibly stressed out. Thanks for all the help so far guys. And sorry if there is any spelling mistakes, posting from my phone.

[A Nonny Moose 8,263]

Actually, this sounds like something messed up your original installation and AVG did its job.

[Elitejohnson 1]

Actually, this sounds like something messed up your original installation and AVG did its job.

Yeah I don't think I worded it very well, I am hoping the mess came from the tmp file corrupting from the game crashing while saving and exiting. And AVG seeing these not behaving as they should in this instance rightly kicked in. Otherwise I have some mystery malware that has gotten past everything hidden away and only tried to knowingly attack SimCity. Which of course isn't by any means unthinkable, but fairly obscure behavior so far. :/ I don't even know anymore.

[A Nonny Moose 8,263]

Did you run a deep scan?

[Elitejohnson 1]

Did you run a deep scan?

Sorry for such a late reply, been one of those days you know? Yes I have, One at the deepest scan settings, multiple sweeps at a slightly lower setting(with AVG, it's the difference between scanning all files, and apparently only infect-able files.)

 

 

 

Edit: I forgot to edit these sooner, sorry about that. Got the file scanned through WildFire, all came back as benign. No viruses could be found anywhere, so I have no idea what went down there, maybe AVG didn't like the crash whilst existing, you might expect I would have had that happened already, but after a long break that was only the second or third day of playing the game for about 15 mins at a time to test something, on this OS with this current av software. Maybe it is my fault for being sadistic enough to keep gaming on Windows 8. Maybe it's time for a clean install of Windows. No matter, thank you all for your assistants on this matter, I should probably make an attempt to get more active in this awesome community and not just pop up once in a blue moon asking for help. (Not sure if to mark this as solved or not, or if that really makes any difference to the forum, so sorry if I should have.)