AVG Antivirus..

[Bokishi]

just deleted Bioshock cuz it thought it was a virus WTF?!

[Meshugger]

What? This doesn't sound too good. I have AVG as well :sad:

[Hell Kitty]

I had to uninstall AVG to be able to install the demo, as it said setup.exe had a trojan or somesuch. This problem seems pretty common, but I'd not heard of a fix for it.

[taks]

at least it didn't attempt to reformat your HDD.

 

taks

[Meshugger]

Maybe Securom fingers around with the admin-settings on your computer? That would be a legitimate reason for AVG to start isolating or deleting your Bioshock installation.

[theslug]

I have avg and it didn't have any issues with the bioshock demo. It did however think this .exe for some really shady program that is used to view streamed video of live OnDemand shows I had never really heard of before was a trojan.

Edited August 30, 2007 by theslug

[Pop]

I have heard talk of Bioshock containing a "rootkit" that attempts to alter Windows admin settings, supposedly to make Bioshock playable on all XP profiles, that cannot be removed short of a reformat, but I don't actually know if that's the case. You never know with these newfangled programs.

Edited August 30, 2007 by Pop

[Kaftan Barlast]

Bioshock does have the latest Securom protection-scam which implants a rootkit into your windows installation. This rootkit cannot be removed short of formating your HDD, so antivirus software does right in warning about it.

 

 

Yet again copy-protection achieves nothing but giving people with legitimate copies grief.

[mkreku]

Does SecuROM install a root kit on my computer?

 

No. SecuROM DOES NOT USE any root kit technology in its implementation. SecuROM Product Activation does place a folder and registry keys on your system. These folders are used only for storage of license information and information to assist with disc authentication. Please do not modify or delete these files. Tampering with these files may result in authentication issues.

 

Source: http://www.2kgames.com/cultofrapture/pc_faq.html

 

 

Hmm.. Who to believe: Kaftan, the copy protection alarmist, or the ones who wrote the code? Tough call.

[Kaftan Barlast]

Im just pasing on info Ive heard from others, so it might not be correct. On the other hand, 2K doesnt want to scare away customers so they can be expectedt to attempt to hush it down.

[Tigranes]

I believe Cant reported in the Bioshock thread the same deal; and yes, my AVG also found a trojan in the demo setup.exe. I had assumed it was because I torrented the demo, but still.

 

Firstly, why so many people finding trojan warnings/etc for Bioshock, legit version?

 

Secondly, taking away Kaftan's credibility question, would anyone put it past a copy protection company to lie about their methods?

 

Thirdly, would anybody really be surprised at copy protection installing rootkits? It's been done before.

[Pidesco]

I have AVG and it didn't make a peep over Bioshock's demo.

[Tigranes]

Well, that's interesting. Did you manually check the files?

[mkreku]

This Internet paranoia.. it's bordering on pathetic. About the root-kit: it's like trying to prove that God doesn't exist. It just isn't possible. If you believe in the root-kit, then there is a root-kit.

 

Read this though: http://arstechnica.com/news.ars/post/20070...-a-rootkit.html

 

Everyone here who complains about the imaginary root-kit.. what issues has it caused you, personally?

[Pidesco]

Not manually, but my AVG is set to do a sweep of the hard drive every morning and it didn't find anything.

[Tale]

SecuROM seems to install 3 things in particular:

1) Hidden registry keys (this is what gets detected as a rootkit)

2) A directory. I don't know if this directory is hidden or not.

3) A windows service that allows non-admin users to access SecuROM functions.

 

Two things to note:

1) A rootkit is a general description of a set of programs which work to subvert control of an operating system from its legitimate operators. Usually, a rootkit will obscure its installation and attempt to prevent its removal through a subversion of standard system security. Techniques used to accomplish this can include concealing running processes, files or system data from the operating system. [wikipedia.org] SecuROM does not subvert any control of the operating system. Nor does it obscure its own installation or prevent its own removal.

2) If it does hide a directory, it's still as much a security vulnerability as if it were a rootkit, so you're practically arguing semantics if on the topic of vulnerability. Even if it's not subversive like a real rootkit.

 

There's no excuse for a game to be hiding anything from the OS (and subsequently the user), anyway. It's not a rootkit, but it is retarded.

 

PS: You can uninstall all of this without a reformat. It's just more complicated than using the uninstaller.

Edited August 30, 2007 by Tale

[Walsingham]

I heard about this in the reviews of the gamee. I have to agree with Kaft. I think this sort of rubbish just punishes regular Joe users.

[Enoch]

Was the trojan that AVG found called "generic 6"? Because about a week ago, my AVG said that that trojan was in both the M2TW 1.2 patch and the installer for the latest Civ4 expansion. A couple of days later, AVG's definitions update stopped tagging those files as harmful. In other words, they've had some odd false positives lately.

[greylord]

Yes, Bioshock DOES have a Trojan, so it's not surprising if your AVG is detecting it. That's like...duh...

 

I even mentioned it in the Bioshock thread as to why I wouldn't play Bioshock on PC and only on Xbox if I were you. I included what it did, and why the developers felt they should include it.

 

Well, I was about to get it when my Nephew warned me about a Trojan it installs (mistakenly called Rootkit by someothers). It is a baselevel line of code which disables the administrative portion of your administrator account allowing all others to access it. This allows the game to have those who are not administrators run it. Unless you go to the base level of windows YOU CANNOT uninstall this trojan/program they give you courtesy of your install of the program or of the Demo. Already installed Bioshock in full or Demo form. Welcome to the shock...you're already infected. Good Luck at getting it uninfected.

 

It also has been stated in some others opinions that it will disable certain functions of items the programmers consider pirated or could be used in piracy. I don't know how this works.

 

2K games has come out and stated, it is not a rootkit, but an accessory for the game. I suppose it's an anti-piracy enhancement to your game...nice of them to think about you so much to prevent pirates on your machine.

 

Check security levels and turn them down?

 

I don't know the specs on your machine but of course I would suppose that would be an obvious gotcha.

 

However if I play it I'll go the other way...playing it on a 360 I think.

 

So, in relation to 2K, how does it feel to have them Sucker you guys! Suckers!

 

Personally, good luck at removing it if you really want it removed. It's a major [word that cannot really be said here] to get rid of. There are three different little items that you have to remove, and they are all at the base level of Windows, so it's not going to be any typical walk in the park. To tell the truth, AVG can detect portions of it probably, but I don't think it will be able to do a complete clean of it due to how low level in the programming this Trojan affects.

[Tale]

Yes, Bioshock DOES have a Trojan, so it's not surprising if your AVG is detecting it. That's like...duh...

 

I even mentioned it in the Bioshock thread as to why I wouldn't play Bioshock on PC and only on Xbox if I were you. I included what it did, and why the developers felt they should include it.

 

Well, I was about to get it when my Nephew warned me about a Trojan it installs (mistakenly called Rootkit by someothers). It is a baselevel line of code which disables the administrative portion of your administrator account allowing all others to access it. This allows the game to have those who are not administrators run it. Unless you go to the base level of windows YOU CANNOT uninstall this trojan/program they give you courtesy of your install of the program or of the Demo. Already installed Bioshock in full or Demo form. Welcome to the shock...you're already infected. Good Luck at getting it uninfected.

 

It also has been stated in some others opinions that it will disable certain functions of items the programmers consider pirated or could be used in piracy. I don't know how this works.

 

2K games has come out and stated, it is not a rootkit, but an accessory for the game. I suppose it's an anti-piracy enhancement to your game...nice of them to think about you so much to prevent pirates on your machine.

 

Check security levels and turn them down?

 

I don't know the specs on your machine but of course I would suppose that would be an obvious gotcha.

 

However if I play it I'll go the other way...playing it on a 360 I think.

 

So, in relation to 2K, how does it feel to have them Sucker you guys! Suckers!

 

Personally, good luck at removing it if you really want it removed. It's a major [word that cannot really be said here] to get rid of. There are three different little items that you have to remove, and they are all at the base level of Windows, so it's not going to be any typical walk in the park. To tell the truth, AVG can detect portions of it probably, but I don't think it will be able to do a complete clean of it due to how low level in the programming this Trojan affects.

 

What you are talking about is seperate from what is mistaken for the Rootkit. IT INSTALLS A WINDOWS SERVICE. Which is quite easy to turn off as it is a windows service and is listed under windows services. The full extent of the administrative abilities it gives to other users I can't speak to, but supposedly it's limited to only SecuROM functions.

Edited August 30, 2007 by Tale

[greylord]

Yes, Bioshock DOES have a Trojan, so it's not surprising if your AVG is detecting it. That's like...duh...

 

I even mentioned it in the Bioshock thread as to why I wouldn't play Bioshock on PC and only on Xbox if I were you. I included what it did, and why the developers felt they should include it.

 

Well, I was about to get it when my Nephew warned me about a Trojan it installs (mistakenly called Rootkit by someothers). It is a baselevel line of code which disables the administrative portion of your administrator account allowing all others to access it. This allows the game to have those who are not administrators run it. Unless you go to the base level of windows YOU CANNOT uninstall this trojan/program they give you courtesy of your install of the program or of the Demo. Already installed Bioshock in full or Demo form. Welcome to the shock...you're already infected. Good Luck at getting it uninfected.

 

It also has been stated in some others opinions that it will disable certain functions of items the programmers consider pirated or could be used in piracy. I don't know how this works.

 

2K games has come out and stated, it is not a rootkit, but an accessory for the game. I suppose it's an anti-piracy enhancement to your game...nice of them to think about you so much to prevent pirates on your machine.

 

Check security levels and turn them down?

 

I don't know the specs on your machine but of course I would suppose that would be an obvious gotcha.

 

However if I play it I'll go the other way...playing it on a 360 I think.

 

So, in relation to 2K, how does it feel to have them Sucker you guys! Suckers!

 

Personally, good luck at removing it if you really want it removed. It's a major [word that cannot really be said here] to get rid of. There are three different little items that you have to remove, and they are all at the base level of Windows, so it's not going to be any typical walk in the park. To tell the truth, AVG can detect portions of it probably, but I don't think it will be able to do a complete clean of it due to how low level in the programming this Trojan affects.

 

What you are talking about is seperate from what is mistaken for the Rootkit. IT INSTALLS A WINDOWS SERVICE. Which is quite easy to turn off as it is a windows service and is listed under windows services. The full extent of the administrative abilities it gives to other users I can't speak to, but supposedly it's limited to only SecuROM functions.

 

This isn't the thing that people have mistaken for the Rootkit? It's in Bioshock. There isn't any rootkit there that I can tell, though one that could be mistaken for one...which is the item which is the backdoor created into your accounts (So one could bypass your security if they desired...though probably via the game). It's a little lowlevel however, and I doubt this could be turned off by Windows. It COULD be used by a SecuRom update to prevent you from utilizing certain programs or resources, OR allowing you TO use certain programs or resources if they so desired. I believe 2K also called it a service, though this one isn't able to be turned off easily as there are three different points of contact in the code at three different locations in Windows. If I mistook something as a Rootkit that's probably what I'd have mistaken it for as it is at a pretty low level of the program. It could be a separate item however I suppose.

[Tale]

Things being mistaken as a Rootkit originated in a rootkit revealer program that noticed a hidden registry key. The mistaken claim of a rootkit does not originate from anywhere else.

 

Now, I have disagreements with what they did install. But to call it a Trojan is as much FUD as calling it a rootkit.

Edited August 30, 2007 by Tale

[greylord]

I wouldn't say so. 2K and SecuRom have stated about the items, but they didn't mention what exactly it was (which HAS been discovered). They didn't tell you that the reason a Rootkit revealer might see it as such is because of the level at which 3 lines of code are put into, nor that they CANNOT be uninstalled. Uninstalling Bioshock OR SecuRom functions WILL NOT disable OR uninstall these items. They are hidden away, so unless one knows what they are looking for, they WILL not find them, and even if they do, unless they go to the actual level of program and code, they can't even be taken off from what I understand.

 

What do you call a program that installs itself without your knowledge, hidden away in another program, that can do things like disable or enable programs as entered (in this case however, only Bioshock is the program (edit: it allows bioshock to be accessed), at least confirmed, some have said it also has portions of it that are centered at disabling certain versions of Nero and other burning programs), and have no normal way of uninstallation. I call it a Trojan, though there are Trojans out there that are easier to detect.

 

However, this DOES come from my Nephew, so I didn't discover it myself but I do trust his statements over all.

Edited August 30, 2007 by greylord

[Tale]

This is why it was detected as a rookit

Microsoft offers a utility called RootkitRevealer located: here. The program will scan your system for rootkits. Once you scan your system, the program will reveal the SecuROM service with this message:

 

 

Edited August 30, 2007 by Tale

[greylord]

This is why it was detected as a rookit

Microsoft offers a utility called RootkitRevealer located: here. The program will scan your system for rootkits. Once you scan your system, the program will reveal the SecuROM service with this message: