My anticheat wont work. HELP!

[Er!c@]

Okay playing in NADL and i have been reffing for them. Yesterday I was reffing and my anticheat was running just fine.


this was while reffing a match. Just yesterday night.


Now when i connect to a server im getting this message.

http://pastebin.com/UZ4gZMtq

and here is a screen shot of my q2 folder. anticheat.dll IS in there. I even went as far as deleting it and re-downloading it.



PLEASE HELP! I don't wanna drop out of nadl for something as stupid as this. Esp when it was working just fine yesterday!

[console]

Now when i connect to a server im getting this message.

http://pastebin.com/UZ4gZMtq

Connecting to 69.9.168.4:27999...

Loading anticheat, this may take a few moments...

anticheat failed to load, trying to connect without it.

This might indicate your anti-virus software has decided to clamp down on the anticheat.dll and prevent it from loading.

Which AV do you use?

[Er!c@]

Now when i connect to a server im getting this message.

http://pastebin.com/UZ4gZMtq

Connecting to 69.9.168.4:27999...

Loading anticheat, this may take a few moments...

anticheat failed to load, trying to connect without it.

This might indicate your anti-virus software has decided to clamp down on the anticheat.dll and prevent it from loading.

Which AV do you use?

I'm not even running an antivirus at this point in time.

[yahoo]

I sometimes got that message too:

"Loading anticheat, this may take a few moments..."

idk what causes it but I think this post is somehow related..

http://tastyspleen.net/quake/forums/index.php?topic=13604.msg137968#msg137968

for me it halts and seems to hang from loading the game probably coz im using r1q2. Aprq2 may allow the game to load but not the ac stuff. idk just my idea.

[l0ckp1ck]

This might indicate your anti-virus software has decided to clamp down on the anticheat.dll and prevent it from loading.

Just out of curiosity, it has never been explained as to why it is even picked up as a virus by anti virus programs. Can someone explain why it is?

[Er!c@]

I sometimes got that message too:

"Loading anticheat, this may take a few moments..."

idk what causes it but I think this post is somehow related..

http://tastyspleen.net/quake/forums/index.php?topic=13604.msg137968#msg137968

for me it halts and seems to hang from loading the game probably coz im using r1q2. Aprq2 may allow the game to load but not the ac stuff. idk just my idea.

uhm i know that if there is lag to the ac server it will fail to load but you just reconnect and its fine.
this isnt even trying to load its just jumping to saying it failed to load then tells me to get a ac compatible client... idk :/

freaking me out! RAWR

[console]

I'm not even running an antivirus at this point in time.

In that case, might need to contact R1CH.  I'm not sure what would be causing it if there's no AV on your system.

[console]

Just out of curiosity, it has never been explained as to why it is even picked up as a virus by anti virus programs. Can someone explain why it is?

Never been explained... except for last time you asked on Sat, May 22 2010?

[18:44:30] *** Alpha (Xile@pool4-83.dyn.winshop.com.au) has joined #tastyspleen
[18:44:41] <Alpha> R1CH u there
[18:45:01] <Alpha> quadz
[18:45:04] <Alpha> anyone>?
[18:45:44] <KindOne> I'm here
[18:45:48] <KindOne> are you there?
[18:45:53] <Alpha> can someone explain this
[18:45:55] <Alpha> C:\Documents and Settings\Alpha1\Desktop\Steve's folder\Programs\anticheat.zip/anticheat.dll     detected: Virus.Win32.Heur!IK
[18:46:04] <KindOne> thats a false positive
[18:46:17] <Alpha> ?
[18:47:20] <KindOne> its a false report... nothing to worry about
[18:47:41] <Alpha> a malware warning comes up after a scan saying high risk and its nothing to worry about?
[18:47:50] *** Tailgunner has quit IRC (Quit: KVIrc 4.0.0 Insomnia http://www.kvirc.net/)
[18:48:09] <KindOne> EVERYONE get that.... its just the way the anticheat is compressed....
[18:48:47] <Alpha> why don't they fix it then so it doesn't come up like that?
[18:49:02] <KindOne> I don't know
[18:49:23] <Alpha> well i am going to remove it. unless i can get a proper explaination i aint using it anymore
[18:50:02] <KindOne> Anti-Virus - Some anti-virus software may report an unknown / heuristic detection within the anticheat.dll file. This is a false positive caused by the way the .dll is packed and can be safely ignored.
[18:50:11] <KindOne> http://antiche.at/
[18:50:51] <[BTF]RR> yep yep I get it every time I want to play
[18:51:29] <KindOne> RR, you know you can add it to your antivirus programs ignore list
[18:51:45] <KindOne> its COMPLETELY safe.....
[18:52:21] <[BTF]RR> I'm to lazy
[18:52:24] <[BTF]RR> :p
[18:53:02] * KindOne hacks RR's computer and adds the anticheat.dll to the ignore list of her antivirus program
[18:53:53] <KindOne> Alpha: What program is telling you that?
[18:54:21] <Alpha> a-squared
[18:55:17] <KindOne> just add that anticheat.dll to its ignore list and you will be fine....
[18:56:42] <KindOne> basically your a-squared gave you a false positive.... like when a woman gets a pregency test, and it says shes pregnet, but the really isnt.
[18:57:38] *** X7_ is now known as X7
[18:59:17] <R1CH> anti-virus is such a crock of shit
[18:59:53] <R1CH> here's an example
[18:59:59] <R1CH> i took Notepad from Windows XP
[19:00:12] <R1CH> and modified the file slightly in a completely harmless way
[19:00:22] <R1CH> you run it, it still runs Notepad and it works just like notepad
[19:01:46] <R1CH> http://www.virustotal.com/analisis/b29ed59a23a8bbade8605c2a5072688ed4be7cea7544ec2d353d45efbac855b9-1274579956
[19:01:53] <R1CH> yet over 50% of anti-virus think its a virus
[19:02:24] <KindOne> R1CH: is there any way to stop it from showing up as a virus ?
[19:02:44] <R1CH> yes, i have to submit anticheat.dll to all anti virus vendors and tell them its a false positive
[19:02:53] <R1CH> then the next update i release they all go back to detecting it again
[19:02:53] <BadBrent> reporting it to each individual software maker and just hoping they will untag it
[19:03:02] <R1CH> so i got pretty bored with that
[19:03:23] <R1CH> they all have their own ways of submitting it
[19:03:26] <R1CH> some i have to login to
[19:03:29] <R1CH> some i have to email zips
[19:03:30] <BadBrent> I wish there was some legal action you could take
[19:03:32] <R1CH> some i upload online
[19:03:35] <R1CH> it's so stupid
[19:03:52] <R1CH> what's worse is they share the definitions too
[19:03:58] <R1CH> once one av detects it
[19:04:04] <R1CH> they share that with the other vendors
[19:04:10] <R1CH> and it spreads the false positive to all of them
[19:04:20] <R1CH> that notepad.exe example is proof
[19:04:35] <R1CH> the notepad.exe isn't even available online
[19:04:46] <R1CH> so how do 50% of av know it's malicious?
[19:04:47] <KindOne> can I have that notepad.exe ?
[19:05:22] <R1CH> i'm keeping it private so the results of this experiment aren't tainted
[19:05:35] <R1CH> i can make you a "malicious" calc.exe if you like :)
[19:05:48] <KindOne> it better run on Windows XP
[19:06:21] <KindOne> what kind of horrible coding did you add to it ?
[19:06:34] <R1CH> i added a few words that are the names of windows functions
[19:06:41] <R1CH> and added some imported functions
[19:06:46] <R1CH> that aren't used by notepad
[19:06:50] <R1CH> that's all i did
[19:07:01] <BadBrent> I think it has a lot to do with people using "free" antivirus software, and not having much of an impact on the software since the developers don't give a shit about what the people have to say about it
[19:07:07] <BadBrent> they just code it and the definitions as they see fit
[19:07:15] <BadBrent> and the general public suffers
[19:07:25] <BadBrent> if everybody still used paid antivirus software I don't think it would be nearly as bad
[19:07:36] <KindOne> my programs have never been flagged as a virus :)
[19:11:59] <BadBrent> some people are just too stupid/cheap/poor to pay money for a decent antivirus program
[19:12:30] <Eternity{FLP}> i use McAfee
[19:12:41] <Eternity{FLP}> and it doesnt report anticheat.dll
[19:12:45] <Eternity{FLP}> as a virus
[19:12:59] <BadBrent> I tried mcafee and it did flag ac.dll as a virus
[19:13:03] <BadBrent> same with norton and AVG
[19:13:06] <Eternity{FLP}> unless i scan with heuristics set to maximum
[19:13:07] <BadBrent> kaspersky seems to be fine though
...
[19:15:00] * Alpha is away -[ fraggin ]- at 12:14:p -[ P:On / L:On ]-

[l0ckp1ck]

yeah but r1ch didn't give any specific insight as to what makes the anti virus detect it as a virus in the first place apart from saying he has submitted it and it still turns up as a virus and saying it is a false positive, what does that mean?

[console]

yeah but r1ch didn't give any specific insight

Yes he did; that was the point of the notepad.exe experiment.

It demonstrates one can do something completely harmless to a .exe file, locally, without even uploading it anywhere, and have dozens of AV programs falsely claim it's a virus.

This is in principle the same as what happens to anticheat.dll when it self-updates.  It changes in a harmless way, and yet gets falsely flagged as infected.

[Slayer :D]

Actually McAfee now detects the newest anticheat.dll .

Anticheat.dll is an obfuscated and encrypted binary to help prevent against reverse-engineering the program. If somebody COULD reverse-engineer it, then it would be possible to program a fake anticheat.dll that reports only the correct hashes to the anticheat server regardless of what is actually running.

If I remember correctly, anticheat.dll uses code to take a screenshot of your quake2 (or possibly your entire desktop) and can send the screenshot to the admins of the server you are playing on. If somebody has hacked anticheat.dll and you are suspicious he is cheating, you could probably take a screenshot of their quake2 and see what it looks like. If you don't receive a screenshot or they immediately disconnect, they might be trying to hide hacks.

[V!RaL]

yeah but r1ch didn't give any specific insight as to what makes the anti virus detect it as a virus in the first place apart from saying he has submitted it and it still turns up as a virus and saying it is a false positive, what does that mean?

It's the way he packed anticheat, Some antiviruses have a hissy fit, Can we get back on topic? This has been done to death, Erica still needs help.

[Whirlingdervish]

If I remember correctly, anticheat.dll uses code to take a screenshot of your quake2 (or possibly your entire desktop) and can send the screenshot to the admins of the server you are playing on. If somebody has hacked anticheat.dll and you are suspicious he is cheating, you could probably take a screenshot of their quake2 and see what it looks like. If you don't receive a screenshot or they immediately disconnect, they might be trying to hide hacks.

You aren't remembering correctly.

The server admins who are running anticheat on their servers have no such access. We can't make it do anything other than kick people for bad files by changing the settings on the server and the hashes in the whitelists. The only person getting info on your memory state beyond the results of the ac file checks that are publicly reported, is r1ch in his logs of his end of the AC system.

AC doesn't need screenshots for proof anyway.. It can see the hacked/redirect code or the signs of tampering in the memory that your q2 client has allocated.

If I want a screenshot I'll just record the time and date and stuff someone the command, then ask that they upload it for me or not come back. If the stuff command doesn't work, or the screenshot is tampered with in any way, they won't be welcome back either.

[Er!c@]

all it took was a flippin reboot. I dont reboot often at all. so i didnt even think. Carry on. Thx anyways.

[Slayer :D]

Apparently, server admins do not have access to screenshots, but r1ch does.

Taken from anticheat.txt, the EULA that comes with anticheat.dll

2. PRIVACY
The software may transmit personal information related to your computers
operating environment. Such information is encrypted before being transmitted
over the Internet using public key encryption technology, ensuring only the
r1ch.net anticheat server is able to read it. Personal information may recorded
in log files and saved on the server for future use. Your personal information
is used primarily to generate a verification code which will either permit or
deny you access to a game server based on the results of certain tests on the
data. Unless outlined below, your personal information will never be shared
with any 3rd party.

Personal information may include (but is not limited to) the following: open
processes, loaded module list, username, presence of any specific files on the
system, operating system version, loaded device drivers, window classnames,
window titles, file versions, system file checksums, game file checksums. In
addition, screenshots of the game environment may be transmitted. Screenshots
may be shared with server administrators and publicly posted should they show
anything suspicious that may be regarded as cheating.