AVG detecting false positive virus infection with TT launcher.

[AC439]

I am using AVG free antivirus for all my PCs. After the virus definition update this morning, AVG scanner reports the toontownlauncher.exe file is a virus.

Since I have multiple computers, I can verify that the new AVG virus def is giving a false positive. I have manually uninstall, wiped clean the disney directory and reinstall TT, same thing.

The workaround is to install the AVG free version 8 scanner (if you are still using ver 7.5 or below), update the virus def after the new installation then configure the "exception" in the virus shield residence module to C:\program files\disney. Older AVG versions don't have the "Manage exception" option.

Basically, as soon as AVG scans the file toontownlauncher.exe, it reports its as a virus. So, just uninstall and reinstall TT won't work.

Until AVG can correct this problem, this is the workaround for running TT.

Steps:

1) Download the latest AVG ver 8 installer.
2) Disconnected from internet (to be sure there will be no possible virus invasion during the AVG reinstallation period)
3) Uninstall AVG 7.5
4) Check TT to see if it will open the lanucher. If yes, your TT is fine. If not, reinstall TT and check if TT launcher will run.
5) Then install new AVG ver 8.
6) After AVG installation, configure "Resident shield" - [Manage Exception] - Add Path to c:\Program Files\Disney
7) Save the settings.
8) Reconnect to internet and update AVG 8 with the latest virus def file.

You should also disable AVG scheduled computer scanning as follows, otherwise the scanner will remove ttlauncher.exe and put it in the virus vault during the scheduled scan:-

In AVG -> [Computer scanner] -> [scheduled scan] -> "disable".

Also, if you run a manual full computer scan, your TTlanucher.exe file will also be moved to the virus vault.

Your TT should run normally.

Hope this help.
- Chip

[Axellia]

Wow this looks very advanced, its making my head hurt.

[PinkDreams18]

Can anyone please help me? I have Windows Vista and I have the new Vista launcher for toontown. Everything was working perfectly fine until this morning. When I clicked on the Toontown desktop icon to play, my AVG software said something about a Trojan Horse SHeur. BILB? I clicked "heal". After that my icon picture changed from the normal blue dog to some other picture. Everytime I click on it a window pops up saying "The ToontownLauncher.exe that this shortcut refers to has been changed or moved, so this shortcut will no longer work properly. Do you want to delete this shortcut?" No matter what I do I can't get it to work. I even uninstalled Toontown and tried to reinstall it. When I click the red download button, Toontown give me the window where I can choose to save or run the program. I click "save" and it begins to download. After it finishes I hear this "ding" noise and no windows pop up. I go to my start menu and click the Toontown-setup option. It starts downloading but midway through it says a Trojan Horse SHeur.BILB has been found and the whole vicious cycle starts again. I have already ran my Spybot scan and AVG scan and everything comes up clean. I have no idea what to do. Nothing in the FAQ on the TT site explains this. If anyone can help me I would GREATLY appreciate it. Thanks.

[PinkDreams18]

Oops sorry Mods! I just found a thread explaining how to fix this. Can you please close this thread? Thanks so much!

[AC439]

If you are not using AVG for virus protection, your head shouldn't hurt at all !

[inguitoinguito]

Thats weird

[PinkDreams18]

Ok, this explains what's going on. I've been having trouble all morning! Thank you so much for posting this!

Looks like I won't be playing TT for a while. There's no way I'm paying $54.99 for version 8...

[AC439]

Virus protection programs examine the data bits and patterns of files to see if anything matches their own virus definition file. If there is a match, it will flag virus and take action. So, if there is an error (bug) made in their virus definition file, it could lead to a false positive. This does not happen a lot but it is also not uncommon. I have seen this few times before. Hope this helps.
- Chip

Originally Posted by PinkDreams18

Ok, this explains what's going on. I've been having trouble all morning! Thank you so much for posting this!

Looks like I won't be playing TT for a while. There's no way I'm paying $54.99 for version 8...

Version 8 is Free !!!!!!!!!!! I downloaded it this morning and didn't need to pay anything. You should be up and running quickly.

[elliebelle]

Thanks so much for this! It worked for me!

I was going a little crazy trying to figure out how to play again! lol

[AC439]

Anytime !

I think Disney should have received many support calls about this today. They should be in contact with AVG to get this fix. But my workaround is only to tell AVG scanner not to scan the Disney files, which we know have no problems.

- Chip

[AC439]

Just to report that I have filed a report with the details of my findings to TT tech support. Hopefully they will come up a solution.
- Chip

[Brite]

Toontastic.
I was about to report it as well.

Btw. how can you be SURE it is just a false positive?
Nothing I have seen this far _convinces_ me that it could not possibly be a virus - that somehow goes undetected by other scanners for now.

Thanks for posting!

[foofoobuni]

Where is this thread? I am having the same problem. My computer keeps detecting toontown.exe as a SHeur.BILB trojan virus.

[toontown dawg]

http://www.toontowncentral.com/forum....php?p=2217985

There it is.

[AC439]

There is a web site that will scan your file using about 20+ different virus scanners. The toontownlauncher.exe file was uploaded to the site and was scanned. Only AVG reported positive. All other scanners reported negative. The site also stated that I was not the first one to send the file for verification. There seems to be more people out there aware of this problem.

Of course, I had proved this as well using multiple computers as a control study. In each one of them, AVG shows positive right after virus def update.

As of this writing, AVG has not implemented any fix yet. AVG did released another newer virus def today. I have manually scanned the TTlauncher file with the new def and still positive.