8 ms·

The review in question: AVOID omega double thumbs DOWN This game installs some random low reputation anti cheat from japan that I have noticed some very stran

The review in question: AVOID omega double thumbs DOWN This game installs some random low reputation anti cheat from japan that I have noticed some very strange behaviors from. First it maintains running even when the game is closed, including tray icons. Also it starts on boot up regardless of boot up settings. It seems to be sending some packets of data to japan IPs while the game has already been closed. If you made the mistake of installing this very suspicious application it took me some time to discover all the traces of it on my PC but I believe I have completely removed it. first uninstall the warlanders game from steam. Check to make sure that C:\Program Files\SentryAntiCheat is gone, not just empty open a commandline and run C:\Program Files\SentryAntiCheat\setray.exe --unins2 just to make sure search your whole PC for ses.exe and setray.exe. Delete any traces that occur Then go here: C:\Users(put your username here)\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Sentry Anti-Cheat Notification.lnk <- delete that finally I searched quite a bit in the registry and mostly everything in the registry is gone relating to this AC. However there still is an entry so get rid of that Win+R button type regedit.exe then navigate to this section: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\SentryAntiCheat <- right click that and press remove then confirm (From https://steamcommunity.com/profiles/76561198128363815/recommended/1675900/ https://steamcommunity.com/profiles/76561198128363815/recomm..., where they failed to purge it from the page source.)

mcintyre1994 4y ago
Based on that I’d guess an algorithm or maybe even person wrongly marked this as instructions for disabling anti-cheat software, without realising that it’s instructions for doing that after removing the game.
- rasz 4y ago
  Most likely cheap idiot contractors. Looks like whoever is managing moderation sucks at their work or doesnt care.
  - somenameforme 4y ago
    It says on the page, "This review has been banned by a Steam moderator..." Probably not even a contractor, but just a volunteer. And now Valve is taking a significant PR hit because of their ineptitude. You get what you pay for.
    - still_grokking 4y ago
      It's not about the censored review. The story here is about the fact that people who marked this review as helpful got punished for doing so. And that's an order of magnitude more severe fuck up.
    - LorenPechtel 4y ago
      And that they didn't quickly step in and reverse it. Mistakes will happen, how they are addressed matters.
  - makeitdouble 4y ago
    I always wonder why people keep attributing this to cheap/unskilled labor. At one level it really doesn't matter as the company is choosing who works for them, and the outcome of their action is the company's action. It's Valve's fuckup anyway we look at it. At another level, qualified and well paid employees also take shitty actions. I'd argue they're often less prepared and less professional than contracted customer support.
    - somenameforme 4y ago
      Because it's out of character. On Steam there are practically no restrictions whatsoever on what you can say in reviews. Even completely irrelevant, off topic, risque, or meme spam reviews are perfectly kosher. A reasonable and relevant review being removed makes 0 sense, and is not something Steam would ever do. So it's obviously somebody who's working for them, that shouldn't be. Of course I do agree with you on accountability. Companies should not use volunteers for remotely relevant positions. If they do, and those volunteers screw up, it's on them.
    - 4y ago
- mananaysiempre 4y ago
  These instructions actually look somewhat strange to me: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\SentryAntiCheat, which is removed at the last step, would normally be the “Add & Remove Programs” list entry, right? Is the poster confused and did they not notice the anticheat in that list? Are the anticheat authors storing bogus data there? This whole thing seems peculiar.
  - _gabe_ 4y ago
    Uninstalling a program via the Add or Remove Programs GUI doesn't clean up the registry entries. I noticed this awhile ago and realized I had hundreds of old registry entries for games I had uninstalled a long time ago. Plus, most people using Steam uninstall games through Steam. So if Steam isn't cleaning up the registry that entry will stay there. I don't think the registry entry will do anything, but it can't hurt to remove it manually.
kekebo 4y ago
Cannot testify for this case but Bulk Crap Uninstaller[0] is usually a reliable way to fully uninstall tenacious windows programs, including potentially left over files and registry entries. [0] https://www.bcuninstaller.com/ https://www.bcuninstaller.com/
- ycombinete 4y ago
  I have used https://privacy.sexy https://privacy.sexy. I love the idea of it, but always cringe when running a batch file as an administrator from a random website.
  - LeoPanthera 4y ago
    ShutUp10 (also works with 11) does this but with a nice UI, and allows you to individually toggle settings, as well as undo them. https://www.oo-software.com/en/shutup10 https://www.oo-software.com/en/shutup10
- farkanoid 4y ago
  I really need to run this on some of the machines at work.
  - jacquesm 4y ago
    I would be very careful with stuff like that if you don't have the capability to audit what you will be running, especially without permission from corporate IT.
- k_sze 4y ago
  I’m gonna try this to get rid of the McAfee nagger that my laptop came with.
matheusmoreira 4y ago
Anti-cheat software is designed to own your machine, take away your control and monitor you. They are indistinguishable from malware. Valve should be taken to task for not only allowing this malicious software in their platform but also for actively distributing it to users. Thank you for citing this. I favorited it as yet another example to cite whenever the topic comes up. Seems to be a trend with japanese companies. Check out the wonderful consequences of allowing these corporations access to your computer: https://github.com/FuzzySecurity/Capcom-Rootkit https://github.com/FuzzySecurity/Capcom-Rootkit https://fuzzysecurity.com/tutorials/28.html https://fuzzysecurity.com/tutorials/28.html
- mananaysiempre 4y ago
  Money quote: “Essentially, [CAPCOM.SYS] provides ring-0 code execution as a service! Its only function is to take a userland pointer, disable SMEP [thus allowing the kernel to execute from userland-owned pages], execute code at the pointer address and re-enable SMEP.”
- xvinci 4y ago
  I mean, yeah you are right calling those out, but there is a plethora of vulnerable drivers from e.g. mainboard and GPU manufacturers, very often installed by default on new machines. I would distinguish between an Anti-Cheat actively doing shady stuff (like it seems to be the case here) and companies simply shipping crappy software - because that's too often the case in many areas.
  - matheusmoreira 4y ago
    That's no excuse. I call those manufacturers out too. The truth is these hardware manufacturers treat software as a cost center, don't invest in it and make shitty software as a result. Honestly they shouldn't even be writing software at all, they should be publishing specs so that better people can write it and mainline it on Linux where it belongs. At least they aren't literally in the business of making malware designed to own people's computers with the express purpose of denying them their computing freedom. That's ultimately what "cheating" is: an exercise in computer freedom. The game is running on my computer, of course I can modify it if I want. Any attempt to prevent me from doing so obviously requires that the computer not obey me anymore. The only thing that separates this crap from malware is some terms of service document nobody reads. I've always been aware that all proprietary software is potential malware but I always gave these developers the benefit of the doubt until the actual vulnerabilities started surfacing. I remember my very first comments on reddit years ago were on a news post about some flight simulator software exfiltrating your browser's saved username and passwords directly to the game company. Let me see if I can dig up that thread. Edit: found it, here it is: https://old.reddit.com/r/flightsim/comments/7yh4zu/deleted_by_user/?limit=500 https://old.reddit.com/r/flightsim/comments/7yh4zu/deleted_b... https://www.pcmag.com/news/flight-sim-labs-fights-piracy-by-installing-malware https://www.pcmag.com/news/flight-sim-labs-fights-piracy-by-... > These idiots sent the passwords over HTTP to a machine running RDP on the public internet!! WTF, this stupidity has to be criminal! Can't make this shit up.

mcintyre1994 4y ago

Based on that I’d guess an algorithm or maybe even person wrongly marked this as instructions for disabling anti-cheat software, without realising that it’s instructions for doing that after removing the game.

rasz 4y ago
Most likely cheap idiot contractors. Looks like whoever is managing moderation sucks at their work or doesnt care.
- somenameforme 4y ago
  It says on the page, "This review has been banned by a Steam moderator..." Probably not even a contractor, but just a volunteer. And now Valve is taking a significant PR hit because of their ineptitude. You get what you pay for.
  - still_grokking 4y ago
    It's not about the censored review. The story here is about the fact that people who marked this review as helpful got punished for doing so. And that's an order of magnitude more severe fuck up.
  - LorenPechtel 4y ago
    And that they didn't quickly step in and reverse it. Mistakes will happen, how they are addressed matters.
- makeitdouble 4y ago
  I always wonder why people keep attributing this to cheap/unskilled labor. At one level it really doesn't matter as the company is choosing who works for them, and the outcome of their action is the company's action. It's Valve's fuckup anyway we look at it. At another level, qualified and well paid employees also take shitty actions. I'd argue they're often less prepared and less professional than contracted customer support.
  - somenameforme 4y ago
    Because it's out of character. On Steam there are practically no restrictions whatsoever on what you can say in reviews. Even completely irrelevant, off topic, risque, or meme spam reviews are perfectly kosher. A reasonable and relevant review being removed makes 0 sense, and is not something Steam would ever do. So it's obviously somebody who's working for them, that shouldn't be. Of course I do agree with you on accountability. Companies should not use volunteers for remotely relevant positions. If they do, and those volunteers screw up, it's on them.
  - 4y ago
mananaysiempre 4y ago
These instructions actually look somewhat strange to me: HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\SentryAntiCheat, which is removed at the last step, would normally be the “Add & Remove Programs” list entry, right? Is the poster confused and did they not notice the anticheat in that list? Are the anticheat authors storing bogus data there? This whole thing seems peculiar.
- _gabe_ 4y ago
  Uninstalling a program via the Add or Remove Programs GUI doesn't clean up the registry entries. I noticed this awhile ago and realized I had hundreds of old registry entries for games I had uninstalled a long time ago. Plus, most people using Steam uninstall games through Steam. So if Steam isn't cleaning up the registry that entry will stay there. I don't think the registry entry will do anything, but it can't hurt to remove it manually.

kekebo 4y ago

Cannot testify for this case but Bulk Crap Uninstaller[0] is usually a reliable way to fully uninstall tenacious windows programs, including potentially left over files and registry entries. [0] https://www.bcuninstaller.com/ https://www.bcuninstaller.com/

ycombinete 4y ago
I have used https://privacy.sexy https://privacy.sexy. I love the idea of it, but always cringe when running a batch file as an administrator from a random website.
- LeoPanthera 4y ago
  ShutUp10 (also works with 11) does this but with a nice UI, and allows you to individually toggle settings, as well as undo them. https://www.oo-software.com/en/shutup10 https://www.oo-software.com/en/shutup10
farkanoid 4y ago
I really need to run this on some of the machines at work.
- jacquesm 4y ago
  I would be very careful with stuff like that if you don't have the capability to audit what you will be running, especially without permission from corporate IT.
k_sze 4y ago
I’m gonna try this to get rid of the McAfee nagger that my laptop came with.

matheusmoreira 4y ago

Anti-cheat software is designed to own your machine, take away your control and monitor you. They are indistinguishable from malware. Valve should be taken to task for not only allowing this malicious software in their platform but also for actively distributing it to users. Thank you for citing this. I favorited it as yet another example to cite whenever the topic comes up. Seems to be a trend with japanese companies. Check out the wonderful consequences of allowing these corporations access to your computer: https://github.com/FuzzySecurity/Capcom-Rootkit https://github.com/FuzzySecurity/Capcom-Rootkit https://fuzzysecurity.com/tutorials/28.html https://fuzzysecurity.com/tutorials/28.html

mananaysiempre 4y ago
Money quote: “Essentially, [CAPCOM.SYS] provides ring-0 code execution as a service! Its only function is to take a userland pointer, disable SMEP [thus allowing the kernel to execute from userland-owned pages], execute code at the pointer address and re-enable SMEP.”
xvinci 4y ago
I mean, yeah you are right calling those out, but there is a plethora of vulnerable drivers from e.g. mainboard and GPU manufacturers, very often installed by default on new machines. I would distinguish between an Anti-Cheat actively doing shady stuff (like it seems to be the case here) and companies simply shipping crappy software - because that's too often the case in many areas.
- matheusmoreira 4y ago
  That's no excuse. I call those manufacturers out too. The truth is these hardware manufacturers treat software as a cost center, don't invest in it and make shitty software as a result. Honestly they shouldn't even be writing software at all, they should be publishing specs so that better people can write it and mainline it on Linux where it belongs. At least they aren't literally in the business of making malware designed to own people's computers with the express purpose of denying them their computing freedom. That's ultimately what "cheating" is: an exercise in computer freedom. The game is running on my computer, of course I can modify it if I want. Any attempt to prevent me from doing so obviously requires that the computer not obey me anymore. The only thing that separates this crap from malware is some terms of service document nobody reads. I've always been aware that all proprietary software is potential malware but I always gave these developers the benefit of the doubt until the actual vulnerabilities started surfacing. I remember my very first comments on reddit years ago were on a news post about some flight simulator software exfiltrating your browser's saved username and passwords directly to the game company. Let me see if I can dig up that thread. Edit: found it, here it is: https://old.reddit.com/r/flightsim/comments/7yh4zu/deleted_by_user/?limit=500 https://old.reddit.com/r/flightsim/comments/7yh4zu/deleted_b... https://www.pcmag.com/news/flight-sim-labs-fights-piracy-by-installing-malware https://www.pcmag.com/news/flight-sim-labs-fights-piracy-by-... > These idiots sent the passwords over HTTP to a machine running RDP on the public internet!! WTF, this stupidity has to be criminal! Can't make this shit up.