Question - MQ .Exe random name and/or virus detection (obfuscation) (2 Viewers)

[Myysterio]

I have been using RG for like 2 years now and today I got this warning for the first time. Just checking to see if its expected. It popped up when I launched MQ.

 

[Sic]

.

Hello folks been using this software for yeas off and on. Recently updated as normal for all MQ2 related plugins and stuff. Went to launch the game on Friday and when i did so i got all 6 of my 12 toons i play logged in. They successful logged in and were in guild hall and were grouped by autogroup plugin. All of a sudden all six of them crashed to desktop. I've never had this happen then all of a sudden Malwarebytes popped up a notice saying Ransome wear detected. And when i looed in my quarantined folder saw this show up. Also for some reason when i log in every time i have to reset all my MQ2 window placement for lua windows like MQ2Nav CWTN ect. Any way to forice MQ2 to save the placement?

i merged your question into the existing thread for this situation.

that random string is your obfuscated .exe

please read the rest of this discussion for context and understanding

 

[Razadine]

Ok foolks thank you for all the info. I tested the issue after the post and ran it with just turning off Malwarebytes and everything just rain fine. So i'm just going in to the program and making that exclusion. Thanks again.

 

[mastar]

Norton quarantined a file on my PC called 1234abcd.exe and flagged it as IDP.Generic. I’m using MQ with MQ2Eskay, MQ2Mage, and MQ2Bard on my SK/Bard/Mage setup, and I’m trying to figure out whether this file is related to MQ or if it’s something I should delete.

Here’s what Norton reported:

• Threat name: IDP.Generic
• Status: Moved to Quarantine
• Detection type: Behavioral Protection
• File is “very new”
• “Very few users” have used it
• Risk level: High

I’m not sure if this is a false positive from Norton or if this file isn’t part of MQ at all. Has anyone seen1234abcd.exe.exe before or had Norton flag something similar?
anyone else had this problem ?
Should I restore it or just delete it?

Thanks for any help.

 

[TempusX]

This is very likely a false positive. MQ has a randomly(?) generated executable it runs from that is unique to (I suspect) your unique HWID. Or Unique to that install. The point is, it's a jumble of letters and numbers that is going to be unique to that particular install. You'll notice in your task manage under the details section, you will never see macroquest.exe, but you'll find a random letter/number.exe. Mine for example, looks like 1234abcd.exe and has the same icon as the macroquest icon (purple, gold lettering).


As a rule of thumb, excluding your MQ folder and EQ folder from virus/malware/etc scanners generally helps with performance.

 

[Davros]

If you want to make double sure it's the obfuscated macroquest.exe file, go to your /MQfoldername/config and open your macroquest.ini and find this entry and see if it matches up.

 

[Sic]

ya'll. it is pretty slim chance - but posting your obfuscated exe defeats the whole purpose of it.

.

 

[Davros]

I renamed it to something else for the screenshot

My luck it's some other poor bastards .exe name and I just outed them though lol

 

[brainiac]

Uninstall Norton. That stuff is just as bad as malware

 

[Sic]

Uninstall Norton. That stuff is just as bad as malware

but i have some sexy single Nigerian princes in my area