Antivirus detecting a file as a Trojan

[Plumpykid1]

Dear OctoWow,

Today earlier, I downloaded the new client patch. The moment I downloaded it, the Windows Antivirus detected the file as malicious, more specifically, a Trojan horse. It says Trojan:Win32/PowExcEnv.RXH!MTB

Affected items:

Affected items :

CmdLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NonInteractive -EncodedCommand dAByAHkAIAB7AAoAIAAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFcAbwB3ACAATwBjAHQAbwAnACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAHQAbwBwAAoAIAAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAFAAQwBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABQAHIAbwBnAHIAYQBtAHMAXABPAGMAdABvAEwAYQB1AG4AYwBoAGUAcgAnACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAHQAbwBwAAoAIAAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIAAiAFcAbwBXAC4AZQB4AGUAIgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwB0AG8AcAAKACAAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAIgBWAGEAbgBpAGwAbABhAEYAaQB4AGUAcwAuAGUAeABlACIAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAdABvAHAACgAgACAAUwBlAHQALQBDAG8AbgB0AGUAbgB0ACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAFAAQwBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAbwBjAHQAbwAtAGQAZQBmAGUAbgBkAGUAcgAtADYAOAAyADQALQAxADcAOAA2ADkAMAA1ADgAMQA1ADYANwAyAC4AdAB4AHQAJwAgAC0AVgBhAGwAdQBlACAAIgBPAEsAIgAgAC0ARQBuAGMAbwBkAGkAbgBnACAAQQBTAEMASQBJAAoAfQAgAGMAYQB0AGMAaAAgAHsACgAgACAAJAB0ACAAPQAgACQAZgBhAGwAcwBlAAoAIAAgAHQAcgB5ACAAewAgACQAdAAgAD0AIAAoAEcAZQB0AC0ATQBwAEMAbwBtAHAAdQB0AGUAcgBTAHQAYQB0AHUAcwApAC4ASQBzAFQAYQBtAHAAZQByAFAAcgBvAHQAZQBjAHQAZQBkACAAfQAgAGMAYQB0AGMAaAAgAHsAfQAKACAAIABpAGYAIAAoACQAdAApACAAewAgAFMAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0ATABpAHQAZQByAGEAbABQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABQAEMAXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAG8AYwB0AG8ALQBkAGUAZgBlAG4AZABlAHIALQA2ADgAMgA0AC0AMQA3ADgANgA5ADAANQA4ADEANQA2ADcAMgAuAHQAeAB0ACcAIAAtAFYAYQBsAHUAZQAgACIAVABBAE0AUABFAFIAIgAgAC0ARQBuAGMAbwBkAGkAbgBnACAAQQBTAEMASQBJACAAfQAgAGUAbABzAGUAIAB7ACAAUwBlAHQALQBDAG8AbgB0AGUAbgB0ACAALQBMAGkAdABlAHIAYQBsAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAFAAQwBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAbwBjAHQAbwAtAGQAZQBmAGUAbgBkAGUAcgAtADYAOAAyADQALQAxADcAOAA2ADkAMAA1ADgAMQA1ADYANwAyAC4AdAB4AHQAJwAgAC0AVgBhAGwAdQBlACAAIgBGAEEASQBMACIAIAAtAEUAbgBjAG8AZABpAG4AZwAgAEEAUwBDAEkASQAgAH0ACgB9AA==




I know that this is a private server and there are cracked plugins etc. However, I am too cautious when it comes to Windows Antivirus detecting something as a virus.

Best regards,

Plumpykid

[Uggerbugger]

try {
Add-MpPreference -ExclusionPath 'C:\Wow Octo' -ErrorAction Stop
Add-MpPreference -ExclusionPath 'C:\Users\PC\AppData\Local\Programs\OctoLauncher' -ErrorAction Stop
Add-MpPreference -ExclusionProcess "WoW.exe" -ErrorAction Stop
Add-MpPreference -ExclusionProcess "VanillaFixes.exe" -ErrorAction Stop

Set-Content `
-LiteralPath 'C:\Users\PC\AppData\Local\Temp\octo-defender-6824-1786905815672.txt' `
-Value "OK" `
-Encoding ASCII
}
catch {
$t = $false

try {
$t = (Get-MpComputerStatus).IsTamperProtected
}
catch {}

if ($t) {
Set-Content `
-LiteralPath 'C:\Users\PC\AppData\Local\Temp\octo-defender-6824-1786905815672.txt' `
-Value "TAMPER" `
-Encoding ASCII
}
else {
Set-Content `
-LiteralPath 'C:\Users\PC\AppData\Local\Temp\octo-defender-6824-1786905815672.txt' `
-Value "FAIL" `
-Encoding ASCII
}
}

Its adding octowow to windows defender exclusion list, which is required for some of the mods to not be blocked. However probably good practice to make people aware and ask instead of just doing...