# Malwarebytes detects, since this afternoon, gems of war as malware

**URL:** <https://community.gemsofwar.com/t/malwarebytes-detects-since-this-afternoon-gems-of-war-as-malware/69609>\
**Category:** Uncategorized\
**Created:** [April 16, 2021, 6:17pm UTC](https://community.gemsofwar.com/t/malwarebytes-detects-since-this-afternoon-gems-of-war-as-malware/69609 "2021-04-16T18:17:00Z")\
**Posts on this page:** 15\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rotschreck](https://sea1.discourse-cdn.com/flex019/user_avatar/community.gemsofwar.com/rotschreck/32/68420_2.png) [@Rotschreck](https://community.gemsofwar.com/u/Rotschreck)\
**Post date:** [April 16, 2021, 6:17pm UTC](https://community.gemsofwar.com/t/malwarebytes-detects-since-this-afternoon-gems-of-war-as-malware/69609/1 "2021-04-16T18:17:00Z")

</div>

Hello

Since last update of malwarebytes, a file of Gems of War (GameAseembly.dll) is detected as malware (Malware.Heuristic.1001, that means 0-day threat).

@Saltypatra, some info about this ?

 ![Sans titre](https://us1.discourse-cdn.com/flex019/uploads/gemsofwar/original/3X/a/9/a9be3099555cd62e703eac07023d7db6e47a642d.png)

---

<div class="post-metadata">

**Author:** ![sls](https://sea1.discourse-cdn.com/flex019/user_avatar/community.gemsofwar.com/sls/32/66687_2.png) [@sls](https://community.gemsofwar.com/u/sls)\
**Post date:** [April 16, 2021, 6:37pm UTC](https://community.gemsofwar.com/t/malwarebytes-detects-since-this-afternoon-gems-of-war-as-malware/69609/2 "2021-04-16T18:37:56Z")

</div>

I knew their monetisation efforts would cross the line eventually! /s

---

<div class="post-metadata">

**Author:** ![Rotschreck](https://sea1.discourse-cdn.com/flex019/user_avatar/community.gemsofwar.com/rotschreck/32/68420_2.png) [@Rotschreck](https://community.gemsofwar.com/u/Rotschreck)\
**Post date:** [April 16, 2021, 6:56pm UTC](https://community.gemsofwar.com/t/malwarebytes-detects-since-this-afternoon-gems-of-war-as-malware/69609/3 "2021-04-16T18:56:01Z")

</div>

Yes, eventually, but how to be sure the file is not infected ? I think it is a false positive. I will test with virustotal.  
A dev answer would be greatly appreciated 🙂

---

<div class="post-metadata">

**Author:** ![Rotschreck](https://sea1.discourse-cdn.com/flex019/user_avatar/community.gemsofwar.com/rotschreck/32/68420_2.png) [@Rotschreck](https://community.gemsofwar.com/u/Rotschreck)\
**Post date:** [April 16, 2021, 7:02pm UTC](https://community.gemsofwar.com/t/malwarebytes-detects-since-this-afternoon-gems-of-war-as-malware/69609/4 "2021-04-16T19:02:28Z")

</div>

Right now, only Malwarebytes detects this file as malicious. So no problem or a very 0-day.

 ![Sans titre2](https://us1.discourse-cdn.com/flex019/uploads/gemsofwar/original/3X/d/a/da38690707cd54a4489d37d94e304b0dacf573eb.png)

---

<div class="post-metadata">

**Author:** ![Snooj](https://sea1.discourse-cdn.com/flex019/user_avatar/community.gemsofwar.com/snooj/32/65852_2.png) [@Snooj](https://community.gemsofwar.com/u/Snooj)\
**Post date:** [April 16, 2021, 7:38pm UTC](https://community.gemsofwar.com/t/malwarebytes-detects-since-this-afternoon-gems-of-war-as-malware/69609/5 "2021-04-16T19:38:05Z")

</div>

What if GoW now does bitcoin mining on our computers? 🤣

Disclaimer: I’m being sarcastic. …Right?

---

<div class="post-metadata">

**Author:** ![Noctis](https://sea1.discourse-cdn.com/flex019/user_avatar/community.gemsofwar.com/noctis/32/68105_2.png) [@Noctis](https://community.gemsofwar.com/u/Noctis)\
**Post date:** [April 16, 2021, 8:52pm UTC](https://community.gemsofwar.com/t/malwarebytes-detects-since-this-afternoon-gems-of-war-as-malware/69609/7 "2021-04-16T20:52:51Z")

</div>

Mongo’s spell is getting too random.

---

<div class="post-metadata">

**Author:** ![Rotschreck](https://sea1.discourse-cdn.com/flex019/user_avatar/community.gemsofwar.com/rotschreck/32/68420_2.png) [@Rotschreck](https://community.gemsofwar.com/u/Rotschreck)\
**Post date:** [April 16, 2021, 9:23pm UTC](https://community.gemsofwar.com/t/malwarebytes-detects-since-this-afternoon-gems-of-war-as-malware/69609/8 "2021-04-16T21:23:56Z")

</div>

It is not the first time Malwarebytes detects GoW as malicious. Sometime it is URL, sometime a file. So wait and see if Malwarebytes fix it.

---

<div class="post-metadata">

**Author:** ![locoblutaxt](https://sea1.discourse-cdn.com/flex019/user_avatar/community.gemsofwar.com/locoblutaxt/32/52337_2.png) [@locoblutaxt](https://community.gemsofwar.com/u/locoblutaxt)\
**Post date:** [April 17, 2021, 4:06pm UTC](https://community.gemsofwar.com/t/malwarebytes-detects-since-this-afternoon-gems-of-war-as-malware/69609/9 "2021-04-17T16:06:33Z")

</div>

Should be rated as Adware… (warning: some irony inside!)

---

<div class="post-metadata">

**Author:** ![awryan](https://sea1.discourse-cdn.com/flex019/user_avatar/community.gemsofwar.com/awryan/32/74650_2.png) [@awryan](https://community.gemsofwar.com/u/awryan)\
**Post date:** [April 17, 2021, 11:55pm UTC](https://community.gemsofwar.com/t/malwarebytes-detects-since-this-afternoon-gems-of-war-as-malware/69609/10 "2021-04-17T23:55:05Z")

</div>

> [@locoblutaxt](#):
>
> Should be rated as Adware… (warning: some irony inside!)

Players have to opt in to see ads in Gems of War. So that’s some faulty detection software if that’s what’s picking it up.

It would be like the FTC coming after a kids lemonade stand because of reports it’s a monopoly in their small town.

---

<div class="post-metadata">

**Author:** ![Ribeyefan](https://sea1.discourse-cdn.com/flex019/user_avatar/community.gemsofwar.com/ribeyefan/32/69310_2.png) [@Ribeyefan](https://community.gemsofwar.com/u/Ribeyefan)\
**Post date:** [April 18, 2021, 4:22am UTC](https://community.gemsofwar.com/t/malwarebytes-detects-since-this-afternoon-gems-of-war-as-malware/69609/11 "2021-04-18T04:22:12Z")

</div>

> [@Rotschreck](#):
>
> Malware.Heuristic.1001

It’s an F/P (FYI, Malware.Heuristic.\* is just a match by their heuristics engine on some part(s) of the code in the DLL (to put it simply), it doesn’t mean 0day).

You can report it via their forums.

Full disclosure: I used to work for them 😉

---

<div class="post-metadata">

**Author:** ![parikl](https://avatars.discourse-cdn.com/v4/letter/p/9fc29f/32.png) [@parikl](https://community.gemsofwar.com/u/parikl)\
**Post date:** [May 1, 2021, 3:34am UTC](https://community.gemsofwar.com/t/malwarebytes-detects-since-this-afternoon-gems-of-war-as-malware/69609/12 "2021-05-01T03:34:19Z")

</div>

I reported the same 2 days ago, but it is still not in the forum. But l got the same virus message with many games on Steam so it affects many other games too.  
I got another message too with the corrupted games: ‘failed to load il2app.’ Now l can not play with GoW that is suck, because l am playing with it every day on my pc. I hope it is only the fault of Malwarebyte and not something else. OUCH!

---

<div class="post-metadata">

**Author:** ![parikl](https://avatars.discourse-cdn.com/v4/letter/p/9fc29f/32.png) [@parikl](https://community.gemsofwar.com/u/parikl)\
**Post date:** [May 1, 2021, 8:34am UTC](https://community.gemsofwar.com/t/malwarebytes-detects-since-this-afternoon-gems-of-war-as-malware/69609/13 "2021-05-01T08:34:49Z")

</div>

After l played with GOw on my mobile l got my virus killer turned off by itself. I think this MUST be something wrong. As l am reading about it on the Forum it has been present for a long time from time to time. Could someone solve it for good?

---

<div class="post-metadata">

**Author:** ![Rotschreck](https://sea1.discourse-cdn.com/flex019/user_avatar/community.gemsofwar.com/rotschreck/32/68420_2.png) [@Rotschreck](https://community.gemsofwar.com/u/Rotschreck)\
**Post date:** [May 2, 2021, 2:50pm UTC](https://community.gemsofwar.com/t/malwarebytes-detects-since-this-afternoon-gems-of-war-as-malware/69609/14 "2021-05-02T14:50:55Z")

</div>

The strange thing is that on Virustotal, malwarebytes do not detect the file as malicious (and it seems antivirus and antimalware on virustotal are all up to date), but the file is still detected as malicious by local Malwarebytes. So weird !

---

<div class="post-metadata">

**Author:** ![Rotschreck](https://sea1.discourse-cdn.com/flex019/user_avatar/community.gemsofwar.com/rotschreck/32/68420_2.png) [@Rotschreck](https://community.gemsofwar.com/u/Rotschreck)\
**Post date:** [May 2, 2021, 2:54pm UTC](https://community.gemsofwar.com/t/malwarebytes-detects-since-this-afternoon-gems-of-war-as-malware/69609/15 "2021-05-02T14:54:17Z")

</div>

> [@parikl](#):
>
> I got another message too with the corrupted games: ‘failed to load il2app.’ Now l can not play with GoW that is suck, because l am playing with it every day on my pc. I hope it is only the fault of Malwarebyte and not something else. OUCH!

You can put the gems of war folder in exclusion in Malwarebytes and then check the game files in Steam. Steam will repair the game by itself and all will be good again. 😉

---

<div class="post-metadata">

**Author:** ![Fourdottwoone](https://sea1.discourse-cdn.com/flex019/user_avatar/community.gemsofwar.com/fourdottwoone/32/66655_2.png) [@Fourdottwoone](https://community.gemsofwar.com/u/Fourdottwoone)\
**Post date:** [November 21, 2023, 9:11am UTC](https://community.gemsofwar.com/t/malwarebytes-detects-since-this-afternoon-gems-of-war-as-malware/69609/17 "2023-11-21T09:11:05Z")

</div>

![image](https://us1.discourse-cdn.com/flex019/uploads/gemsofwar/original/3X/5/d/5dbc53107efa926311bb293e352292f273661a75.jpeg)
