This is a sample guest message. Register a free account today to become a member! Once signed in, you'll be able to participate on this site by adding your own topics and posts, as well as connect with other members through your own private inbox!
Update regarding the Antivirus detection of starter.exe
A user recently reported that antivirus detected the starter.exe file included with the Allods Online 3.0 client as:
Malware.AI.3374321251
First of all, I would like to thank them for reporting it.
Security warnings should never be ignored, even when they eventually turn out to be false positives. Reporting the detection allowed me to investigate the file properly and improve the client release for everyone.
Investigation result
After analyzing the reported executable, I confirmed that the original starter.exe was not a virus.
The detection was a false positive caused by the way the old executable was built and by the operations it performed.
The original utility only executed the following operations:
Code:
del /F /Q ..\Launcher_English.exe
move ..\Launcher.new.exe ..\Launcher.exe
start /high AOgame.exe
Its purpose was therefore limited to:
Deleting the previous English launcher.
Replacing it with the newly downloaded launcher.
Starting the game executable.
During the analysis, I found:
No network communication.
No external URL.
No file download functionality.
No registry modification.
No persistence mechanism.
No process injection.
No use of WriteProcessMemory or CreateRemoteThread.
No obvious obfuscation.
No additional hidden behavior.
Why Antivirus detected it
Malware.AI.3374321251 is a generic detection generated by Malwarebytes' artificial-intelligence and heuristic detection systems. It is not the name of a confirmed malware family.
The old executable combined several characteristics that can appear suspicious to antivirus software:
It was not digitally signed.
It did not contain publisher or version metadata.
It used system() to execute Windows commands.
It deleted and replaced executable files.
It launched another executable with high process priority.
It was a very small PE32 executable compiled using an old MinGW/GCC toolchain.
It had very little public reputation because it was only distributed with this client release.
Taken together, these characteristics were enough to trigger Malwarebytes' heuristic engine, even though the actual behavior of the file was harmless.
Malwarebytes provides additional information about this type of generic detection here:
Although the original file was harmless, I decided not to simply tell users to ignore the warning or exclude the entire client folder from their antivirus.
Instead, I took the time to completely rebuild starter.exe from scratch using a cleaner and more transparent implementation.
The new version:
Does not use system().
Does not execute command-line instructions.
Uses the Windows API directly for file operations.
Uses the Windows API directly to launch the game.
Includes application, publisher and version metadata.
Performs only the required launcher replacement and game startup operations.
Is built from publicly available source code.
Source code and download
To make the behavior of the new utility completely transparent, I have published its full source code on GitHub.
Anyone can inspect the project, review the implementation and verify that the program only performs the operations described above.
If you have already downloaded the Allods Online 3.0 client and have not deleted it, you can use either of the following options:
Download the updated client archive again from the Allods Developers Community.
Download the new starter.exe from the GitHub release and manually replace the previous file.
You do not need to exclude the entire client directory from your antivirus.
If Malwarebytes quarantined only the previous starter.exe, you can simply replace it with the newly rebuilt version.
The actual game executable can also normally be launched directly through:
bin\AOgame.exe
However, the automatic launcher replacement process relies on starter.exe.
Final note
Once again, thank you to the user who reported the detection.
Even though the original file was confirmed to be a false positive and contained no malicious behavior, the report helped make the release cleaner, safer and more transparent.
Publishing the complete source code also means that users no longer have to rely only on my explanation: everyone can now inspect the utility and verify exactly what it does.
This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
By continuing to use this site, you are consenting to our use of cookies.
![Allods Online 3.0 Client [Community Edition]](/data/resource_icons/0/105.jpg?1785943788){kind=icon}
