Zygorguidesclient.exe infected with W32.Malware.Gen

[1manarmy]

Hello Zygor support, I can't access my guides due to this malware in your exe. I had no problem with it 2 weeks ago but now that I'm playing ESO again it's been a problem and I tried to download a new client file but your link is borked please help.

[ZG Support 1]

You've either got a really crappy anti-virus software or something else has infected your machine causing downloads to be infected because our ZygorGuidesClient.exe file that you can download from the Members Area is considered clean by 54 different anti-virus packages.
https://www.virustotal.com/en/file/f...is/1403493281/

And yes, I downloaded that from the Members Area like you would have to do and then uploaded it and had it re-scanned since there was a result in there from 3 days ago.

[1manarmy]

probably not the right response to a valued customer but I'm getting this error while attempting to download a new file
Firefox can't find the file at http://zygorguides.com/javaclient/di...idesClient.exe. For the record W32.Malware.Gen is not a virus.

[ZG Support 1]

Malware (by definition) covers all of the nasty stuff like viruses, trojan horses, worms, etc. so I'm not sure how you determined that W32.Malware.Gen is not a virus.

As for what you are seeing, Win32.Malware-Gen refers to a range of malware applications that infect computers running a 32-bit version of the Windows operating system. Depending on which version of Win32.Malware-Gen your computer is infected with, the virus may download and install other viruses, monitor computer activities, log keystrokes or corrupt your system registry and files.

Again I will reiterate, our file is totally clean without virus or malware. Either your anti-virus is giving you a false positive (and blocking you from downloading) or you already have a virus on your system that is causing the problems.

Firefox by itself does not block you from downloading an infected file so it must be your anti-virus that is doing this. I even used Firefox to download that file and upload it to virustotal.com last night so I know it's not the browser doing it. If you'd like to tell me your software you're using to detect the W32.Malware.Gen I'll be more than happy to download it, and scan the file here to confirm if it's giving a false positive.

Edit: You can even see at the virustotal.com link that there were programs like Malwarebytes and Ad-Aware that scanned the file and found nothing wrong with it. Those are programs that aren't exactly what one would call anti-virus.

[1manarmy]

using webroot secure anywhere, running Windows 7 Professional 64 bit. Rig is roughly 1 month old windows score 7.8/7.9

I was able to download the file using windows explorer, how do you recommend I uninstall the old file?

[ZG Support 1]

Ok, I can confirm that for whatever reason Webroot sees that virus in the client file. I know that it's not infected but I do not know why Webroot is giving the false positive. My best guess is that the heuristics in Webroot see that the .exe file will download a .jar file for running and thinks this is virus activity when it's part of the client design.

To remove the old client, first delete the desktop shortcut, then delete the ZygorGuides_Updater.exe file in you WoW/Interface/Addons folder, then run a registry cleaner program like CCleaner or Registry Recycler.