Windows Malwarebytes detects GMS2 Malware?!

[HollowThreat]

It detects Adware.Eszjuxuan for cefclient.exe

Anyone get the same warning? flase alarm I believe?

 

[csanyk]

I use malwarebytes, and have had no warnings from it when using GMS2, or building/playing GMS2 games.

I take that back. It just came up in my most recent scan, which completed a couple of minutes ago.

 

[mazimadu]

Same here: Here are the details I got back using malwarebytes:

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 12/7/2016
Scan Time: 1:03 AM
Logfile:
Administrator: Yes

Version: 2.2.1.1043
Malware Database: v2016.12.07.05
Rootkit Database: v2016.11.20.01
License: Premium
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

Files: 2
Adware.Eszjuxuan, C:\Program Files\GameMaker Studio 2\cefclient.exe, , [bac71cc8a4f637ffd4602b81768abe42],
Adware.Eszjuxuan, C:\Users\Obinna Emelumadu\GameMakerPlayer\BrowserExtension.dll, , [4b36eff5138777bf0331cede47b97090],

 

[Symmetrik]

I can also confirm that this is true. Malware Bytes brought up 2 of the Adware.Eszjuxuan detections in cefclient.exe. I'll assume that this is most likely a false positive.

 

[TogaMario]

Having the same results. Is this anything we should be concerned about?

 

[Daniel Jackson]

False positive?
I have Malware Bytes too, so I don't know if I should launch GMS2 now. What does it do to the 'infected' files? Does it just block the internet connection or does it try to delete or quarantine the files? (possibly breaking GM) ?

 

[GMWolf]

My antivirus (trend micro) has marked gms2 as a risk before. But after a gms update i haven't had any issues whatsoever.

False positives are quite common with early software titles... But caution is still important...

 

[Juju]

"cefclient.exe" is the Chromium Embedded Framework, and presumably "BrowserExtension.dll" is a layer to interface with that. GMS2 uses Chromium for delivering some content, though I believe YYG are looking to strip it out. I think? Don't quote me on that.

imo, this isn't a concern at all. Is a checksum available for the GMS2 downloads? That'd help verify nothing malicious has snuck in.

 

[csanyk]

False positive?
I have Malware Bytes too, so I don't know if I should launch GMS2 now. What does it do to the 'infected' files? Does it just block the internet connection or does it try to delete or quarantine the files? (possibly breaking GM) ?

Even if this is a valid detection, it's just an Adware class malware, not something infectious. The worse that should happen is that you'll see advertisements from YYG (perhaps stuff pertinent to their own product? I doubt they're selling advertising to sponsors, at least not currently) and maybe they're gathering data on you that they could hope to sell to advertisers (they certainly are gathering data; I'm less clear as to whether this is their mechanism for doing so, but it could be).

It's not malware in the sense that it is going to infect your system, do destructive things to your data, spread to other systems, etc.

At least that's my understanding of the Adware classification. Hopefully someone from YYG will respond soon to clarify what's going on.

 

[Mike]

This is a false positive. We don't have any Adware in GMS2. The 2 programs/dlls are just the way the CEF works.

 

[TogaMario]

Thanks for clearing that up, Mike.

 

[Daniel Jackson]

Someone at the Malwarebytes forum has reported this. Their staff has confirmed it as a false positive and say it will be fixed in the next database update.