GameGuard is downloading Trojans?

[Sinue_v2]

Ok, so when my PC kicks up it's routine virus scan - out of curiosity I check the Virus Vault. It's always been empty, but I still like to check it ocassionally. So to my surpise, I see two objects being quarantined as Trojan Proxy PKQ's - both in Phantasy Star Universe's GameGuard folder - and both downloaded 6-30-07, the last time I logged into PSU and when I recieved the latest GameGuard update. The file names are:

npgmup.des.new
npgmup.des

So I'm curious - is AVG mistaking GameGuard downloads for viruses, and if so - will their quarantine cause GameGuard to freak and possibly suspend my account for trying to circumvent the GameGuard system? Or - did some ingenious hacker manage to find a way to use GameGuard service to automatically download and install viruses on people's computers enmasse?

I'm just looking for information at this point. I've been playing other versions - so I'm not really worried about this at the moment.

[Mayu]

My AVG doesn't say there trojans o.0 Strange

Interesting

[Sinue_v2]

I dunno why it would appear on mine, and not on yours. I don't think I've even messed with the security setting - or if it even has one.

Anyhow, screencap for the curious.

http://img.photobucket.com/albums/v203/Sinue/PSUTrojan.jpg

[Mayu]

Well I just scanned the two files

- - Search

npgmup.des

- Scan AVG

I scanned both of the files

- - No infection

[Sinue_v2]

I assume you have the latest AVG definitions update?

I know AVG uses heuristics to identify potential threats, so I guess it's possible that AVG happened to see these files as a potential threat and then flagged them as Trojans since that's what they most closely matched.

I've done some looking around on the net, and a few other people have come across this as well using various varieties of virus scanners - and the general consensus is that there's no threat, so I'm inclined to believe that for now. Though till I get a new graphics card, I probably won't be logging into the PC version anytime soon reguardless.

Still curious as to weither or not having these files quarentined will affect the login process though. If AVG keeps picking them up and trying to quarantine them, I suppose I could have it overlook that folder - but I'd prefer to have total coverage in my virus scans.

[Mayu]

yep

everythings up to date

http://www.pso-world.com/images/phpbb/icons/smiles/anime1.gif I don't know how your gg got infected o.0

[VioletSkye]

Neither of those files is anything to worry about. Tell AVG to ignore them and GG should not be affected. I think part of the issue is the UPX packer it contains. UPX is used for packing executable and was/is widely used to pack trojan executables like sub7. I only know that because I used to mess around with some of the client/host trojan apps back in the day lol.

<font size=-1>[ This Message was edited by: VioletSkye on 2007-07-01 10:44 ]</font>

[xxShinobi]

Yeah, you've gotta remember anti-virus programs are programmed to go off on ANYTHING just like Vista is paranoid about gamegaurd accessing PSU or BB game files or vice-versa.

I've never used AVG but it looks like it's just doing it's job, plus I'm sure you would've noticed any odd system abnormalities by now. =)

[Khaleb]

It's not just AVG... those same files also trigger my brother's AntiVir whenever he launches PSU. As soon as game guard checks the versions on all of its files, those two will send off a warning message. It's gotten t the point that he just has to Disable AntiVir when launching PSU. We've even done in-depth comparisons between his cpies of the files & mine (even to the point of replacing his copies with mine), and they still set off the warning. I'm pretty sure that some AV programs just tend to get a little touchy whenever they detect anything that wants to run in the background and hijack system/network processes (which is basically how GG does its thing).

Anyway... I'm 99% sure that the GG files you mentioned are safe. If you still aren't sure, though, you can always just trash them (rename & back them up first, as a precaution) and let GG re-download them. If you still get the message for those 2 files, then it's just your AV program.

I hope this helps.

-K

[mrnanoblast]

it happened to me before and it would let me do anything at all like i couldnt get on the internet or play wow

[Thalui89]

Just ran AVG virus scan on my comp. Lone behold i find a virus, not in a psu related gameguard file but ina lineage 2 game guard file. not sure how it got there but found it suspicous after readin this topic.