Antivirus thinks RoR is a Bitcoin miner

[Takkun]

Malwarebytes just started saying that RoR is a bitcoin miner. Anyone else see this?

[Luuca]

THAT explains A LOT

[courtsdad1]

Did you get a response about this issue. Just happened to me as well.

[wargrimnir]

I thought we were a generic trojan. Guess we're moving up in the world.

This is a generic detection flag, these are handed out to unknown processes. To verify for yourself what the launcher is doing, here's some stuff.

1. Open task manager, go to Performance tab, click Resource Monitor
- Find the RoRLauncher.exe file, and check the CPU usage and Thread count. Tick the box and your Disk and Network sections will be filtered by that process.
- On my machine with the launcher open, there's 16-18 threads, and no disk or network activity when it's idle.
- If you scroll up and down the news section, you'll get a little bit of disk activity as it loads in some DLL's that the launcher uses to display stuff. If you let it sit for a little while, they unload themselves, and activity goes back to nothing.
- Click connect on the launcher, go back to Resource Monitor, and you'll see a couple more things load up under Disk activity. After about 20s these files are no longer needed and go back to doing nothing. Once the game is running, the launcher also goes back to 0 CPU usage.

That's all the Launcher does in the background. Once the game is running, you're not going to see any activity from it. You can close the launcher and the game still runs fine. It's just used for connecting to the server or showing you some news, then it goes idle again.

That would make for a pretty crappy bitcoin mining tool.

Why do we get flagged for stuff like this? Dunno, but it happens all the time to relatively unknown software. Could we get Malwarebytes and other antivirus companies to whitelist us? Probably, but they might want some money for it.

If you're paranoid, feel free to watch it doing a whole lot of nothing. If you trust us and want to play, just whitelist it in your various security tools, because I don't see us paying anyone to put us on a whitelist in the near future.

[MaxHayman]

Received this reply.

Hello Max,
.
I have asked the researchers to check this file and I have been told that this block will be lifted. Please give it an hour or so for the update to go through.


I would like you to update the Malwarebytes Anti-Malware database and then try to access the file you were getting the block from once more and let me know if you still receive the block.


Open Malwarebytes
Click on Dashboard on the left
Next to updates click where it says "Current"​

[Metras]

Hey,

i downloaded the newest update of the Malwarebytes-Database today and tested it.

Result: It stills shows that RoR is a bitcoin miner.

[saupreusse]

Easy solution: uninstall malwarebytes :^)

[Darks63]

Having a similar issue using Avast anti virus.

[normanis]

my avast/avg think ror. launcher and 32/64 bit exes are trojans. ( even i make exeptions for tham) . only way to play ror is disable antivirus launch ror.launcher. and than enable again antivirus.
p.s i even send as email to tham its false report, byt seems. they didnt received.
have no idea why it is like that never been such thing in my lifetime. antivirus make exe file trojan byt dont remove it to carantine. most of time if antivirus found trojans/viruses they are moved to karantine without mercy. byt ror exe just stay and any time u click it it trojan byt exe stay where he is ( not in karantine)

[Rydiak]

You didn't happen to notice this was a three-year old thread, did you?

Well now he deleted the post, so I look like an idiot.