A Look At GameGuard

[nestharus]

Form your own opinion on it from this information : )
 

I encourage people from NC Soft to read this thread as well if they aren't aware of everything that GameGuard does =).

 

 

So first, a look at GameGuard from security.stackexchange -> http://security.stackexchange.com/questions/31870/how-dangerous-is-game-guard

 

Next, an article on it

http://www.alteredgamer.com/pc-gaming-tech/1710-beware-of-the-game-guard/

 

 

***Important Information*** Read all threads ***

Next, a post on it that links to 3 other threads about it -> http://www.clylla.com/forum/showthread.php?687-GameGuard-is-Safe-Right-Think-Again!

***Important Information*** Read all threads ***

 

 

A quote from the wikipedia page.

 

 

Quote

 

nProtect GameGuard (sometimes called GG) is an anti-cheating root toolkit developed by INCA Internet. It is widely installed in many online games to block possibly malicious applications and prevent common methods of cheating.^[1][2][3]nProtect GameGuard provides B2B2C (Business to Business to Consumer) security services for online game companies and portal sites. The software is considered to be one of three software programs which "dominate the online game security market".^[4]

GameGuard hides the game application process, monitors the entire memory range, terminates applications defined by the game vendor and INCA Internet to be cheats (QIP for example), blocks certain calls to Direct X functions andWindows APIs, keylogs your keyboard input^{[citation needed]}, and auto-updates itself to change as new possible threats surface.^[1]

Since GameGuard essentially works like a rootkit,^[2][5] players may experience unintended and potentially unwanted side effects. Since the game's process cannot be stopped from the task manager, if the protected game has an infinite loop or hangs in any way, it is effectively impossible to close without logging out or restarting the computer. This is even more frustrating since GameGuard checks if it is already running on the game's launch and does not permit the player to start a new instance in such cases. If set, GameGuard blocks any installation or activation of hardware and peripherals (e.g., a mouse) while the program is running. Since GameGuard monitors any changes in the computer's memory, it will cause performance issues when the protected game loads multiple or large resources all at once.^[6]

GameGuard possesses a database on game hacks based on security references from more than 260 game clients. Some editions of GameGuard are now bundled with INCA Internet's Tachyon anti-virus/anti-spyware library, and others with nProtect Key Crypt, an anti-key-loggersoftware that protects the keyboard input information.

 

 

 

From reddit

 

 

Quote

 

Rootkits can do some funky stuff man...and GameGuard from what i've been reading does things that only malware does to "protect" the game from hacking...Also a program like GameGuard can cause issues with stability since at the system level its running at, it can *cricket* with the memory of all running processes ;)

 

 

 

 

Quote

 

Us in the IT field would consider this malware, since it doesn't get removed when the program is uninstalled, and very invasive in its activities.

 

 

 

 

Quote

 

Thats what anti-cheat programs do. They are designed to invade your computer like a virus and terminate anything it does not like, because cheap programs act in exactly same way. solution is to boycott games that use anti cheat bloatwares instead of doing server based anticheat that cannot be circumwented (Punkbuster, Game Guard, Game Spy, you name it, CAN)

 

 

 

 

Quote

 

If you use processexplorer to see the command line used to launch GameGuard you'll see that it's not a path. It behaves like a rootkit to prevent usage of cheats.

The problems is that GameGuard is so flawed that it'll BSOD the shit out of your system or even prevent anti-virus programms from running, destroy your DNS cache (and lock it) while detroying your performances.

Oh and you still can inject DLL to cheat the usual way.

 

 

 

From steam

 

Quote

 

To add to my previous post for anyone else reading, thousands of people play games with GG and don't seem to have issues with it, and GG isn't flagged by most (all?) antivirus/malware detection software. It's reasonable to assume that GG is not a virus or malware, and is a legitimate (but not necessarily competent) security product. But as with anything that has such privileged access to your computer, this can open up vulnerabilities that can be exploited by less-friendly parties or software, like the ol' Sony rootkit scandal.

I don't want to discourage anyone from trying RaiderZ or other GG games, but if anyone notices odd behavior from their computer after installing or while playing the game, it's possible that it's GameGuard related. Whether or not this is acceptable is up to individuals to decide.

I've played many games with various anti-cheat systems, and this is the first (at least in recent memory) that has noticeably interfered with other programs on my computer. Again, I could be wrong about the association, but if I find out otherwise then I'll report back.

 

 

 

Some history on why Game Guard does what it does the way it does it.

 

Quote

 

Why does Game Guard hide the application, terminates specific applications, blocks calls to Direct X, and does not keylog your keyboard input it simply monitors it.

Why does it do this? Back in 2006 when International GunZ was released there was an onslaught of hackers that almost fully killed the game. They would use injection methods, game file methods, etc. The only way they could combat it was by doing the methods stating above so you can not inject, hotkey, macro, or anything to hack the game.

The problem with it was that GunZ was a very competitive game and was basically a sport in Korea so making sure it wasn't hackable was much more important than anything else.

Why monitor the keyboard? Keyboards with extra F or G keys could be macroed to level up while afk for endless hours, prevents ALT commands that can be used by an injected dll, prevents ALT commands that can be used by editing the game files.

RaiderZ uses the same Game Guard hack prevention software because it was developed during the time GunZ was big.

Don't freak out, it's not a virus, it's just the Norton's AntiVirus of Hack Prevention software.

 

 

 

Conclusion. Malware Bytes is an AV.

 

 

Quote

 

The only real way to remove gameguard is manually removing files and manually editing the registry, Gameguard actively updates to circumvent programs like malwarebytes from detecting it and removing it for being a rootkit.

 

 

 

 

 

 

 

How Effective Is GameGuard?

 

I decided to do research into GameGuard's effectiveness, so I visited some shady sites to see if people were being banned as a result. The results are GameGuard isn't really doing much. It was a minor 2-3 hour annoyance : (.

 

 

I plan to put up another thread discussing the war against the cheaters, which will kind of shed some light on what NC Soft has been doing : ).

 

*edit*

GameGuard was recently updated to activate its heartbeat. GameGuard is now highly effective! : )

 

You can be sure that nobody is able to deactivate GameGuard right now, so if you see any bots, they are running with GameGuard, meaning that they are going to be banned =D.

 

Does this justify its heavy cost? I leave that up to you to decide. There are other ACs out there that also have heartbeats that even over the course of 4+ years, have not been bypassed. These other ones only read your machine. 

 

GameGuard is likely being used by NC West because they get a discount being under NC Soft.

[Thelongjourney]

Bumping for being informative.

[Zel]

As an IT Admin, the only difference between GameGuard and Malware, is that companies pay for GameGuard.

[Sylvexis]

Good post.

 

8/10 would read again.

[ShadowRose]

This was an interesting read.

 

Nc should get another security program that is good preferably server based and that would probably fix the entire botting/hacking/banning problem in 1 shot.

[LilithDragonFlower]

I agree and have been trying to get "NCsoft to respond" and remove this from this game because "I will no longer allow Game Guard" to run on my system.

 

. While Game Guard was installed, I noticed compromised game accounts not related to "Game Guard" did a full system sweep with Malware scanner, Anti Virus, didn't detect anything. ( I am now questioning this related to Game Guard too.)

 

--> Honestly it wouldn't be bad if Hackers started compromising computers running this Anti - Cheat IMO because if that happened then perhaps people would wake up and no longer use such programs on their computers, of course I wouldn't be effected though because I removed them from my system, and sometimes it takes something like this to prove a point, not asking people to do anything illegal, but even popping up a black screen with a warning message on millions of users one time saying "Game Guard just compromised your computer security" then not doing any harm when closed would be enough to teach people a lesson.

 

. What I do know for sure is that with (Game Guard) on my system before I removed this along with "XingCode3" I had problems running other games and services not related to games that required "Game Guard" because of the way Game Guard scans memory, and was doing something to my network causing packets to arrive somewhat out of order, causing performance issues in more than one way.

 

When I removed both these programs off my computer my issues stopped, so now I no longer play any game that requires them, but NCsoft support told me they would not require me to have to install "Game Guard" to play Blade & Soul so I paid a premium subscription, and purchased other items in game because I trusted the information I was given now I am told I can't play without installing it?

[Elvenmad]

  Funny thing about Gameguard and other programs like it are they are just programs that look for things they are told to look out for, some one at some point will have had to have made the scrypt/hack or whatever first for it to be added to its search system and then some one will have had then update GG to look for it and most of the time its the very same independant people who write both, the 'hack' and the 'anti hack' its just win win for them  they sell the hack, go design another one, then sell the 'anti hack' to companies and release their new one,  they make money designing it then even more for selling a solution LOL. what ever systems, program out their is always one step behind

[Fuz]

Quote

 

Us in the IT field would consider this malware, since it doesn't get removed when the program is uninstalled, and very invasive in its activities.

 

Wait, what?
How do I remove it then?

[nestharus]

5 minutes ago, Fuz said:

Wait, what?
How do I remove it then?

 

The article I linked to near the top has a link to another article near the bottom of it discussing how to remove it from your machine. Keep in mind that uninstalling the game is the first step. I think this is a bit drastic ; ).

 

 

It only activates when the game starts, so it shouldn't be that big of an issue so long as you don't start the game. That isn't to say something else couldn't start it.

 

If it is removed from the game, then we can take measures to remove it from the system.

 

  Funny thing about Gameguard and other programs like it are they are just programs that look for things they are told to look out for, some one at some point will have had to have made the scrypt/hack or whatever first for it to be added to its search system and then some one will have had then update GG to look for it and most of the time its the very same independant people who write both, the 'hack' and the 'anti hack' its just win win for them  they sell the hack, go design another one, then sell the 'anti hack' to companies and release their new one,  they make money designing it then even more for selling a solution LOL. what ever systems, program out their is always one step behind

 

Please read the last quote in the post. GameGuard operates the way it does for a reason : ).

[Fuz]

1 minute ago, nestharus said:

 

The article I linked to near the top has a link to another article near the bottom of it discussing how to remove it from your machine. Keep in mind that uninstalling the game is the first step. I think this is a bit drastic ; ).

Well, I mean, I'm gonna do it when NC *finally* decides to spare us from that plague.

[nestharus]

6 minutes ago, Fuz said:

Well, I mean, I'm gonna do it when NC *finally* decides to spare us from that plague.

 

I just wouldn't start the game while GameGuard is active. You're putting your system at risk for the sake of a game.

[FaeQueen]

This is very informative and scary. I will continue to play but I do  not know if I will put anymore money into this game. Maybe my monthly premiums but we shall see. My wife and I played BnS since Headstart without issues and then this patch came out and poof. So many problems with programs that wren't even on our pc... GG kept closing her client saying skype crashed and skype is not on her pc. Then it started to act up on mine. It said webfault failed. Um this is not on my pc either soooo... Yea I love BnS so much but GG will ruin this game if they keep it. See if GG is hacked then everyone playing BnS and all other games using GG will be screwed. 

[LilithDragonFlower]

9 minutes ago, nestharus said:

 

I just wouldn't start the game while GameGuard is active. You're putting your system at risk for the sake of a game.

If you started the game at all even with "Game Guard" not active you installed game guard likely, and will need to manually remove, and block "Game Guard" via your fire-wall if you intend to try to play blade and soul its what I did and why I can't play I don't have game-guard installed and not intention to install it.

[nestharus]

1 minute ago, LilithDragonFlower said:

If you started the game at all even with "Game Guard" not active you installed game guard likely, and will need to manually remove, and block "Game Guard" via your fire-wall if you intend to try to play blade and soul.

 

You will have installed Game Guard, but it won't be active unless the game is started. It will just sit on the system doing nothing. It's when it's running that it's really dangerous.

 

I wouldn't take matters into your own hands with blocking and disabling GameGuard. This is what the hackers do and is likely against the TOS.

 

As mentioned, when GameGuard gets removed from Blade & Soul, we should be able to safely remove it from the system : ). It's either that or uninstall Blade & Soul until it gets removed from the game. I mean, if you really want it off of your system, option #2 is the only legal way.

 

[se]

Yeah, I had known about what a cancer GameGuard is years ago, it riddles a system with errors, and since it attaches itself to windows like a plague, an error in the program may be really troublesome. 

I had had a lot of issues since yesterday with the errors it gave after the update, but I'd just restart the game; however, a few hours ago it crashed and it would refuse to close even with terminate process in task manager. I restarted my pc and opened the client and as soon as Gameguard popped open I got a windows error and my whole system crashed; tried again, same thing, it's insane this trash can harm my whole system on top of being invasive and doing nothing. 

[nestharus]

3 minutes ago, se said:

Yeah, I had known about what a cancer GameGuard is years ago, it riddles a system with errors, and since it attaches itself to windows like a plague, an error in the program may be really troublesome. 

I had had a lot of issues since yesterday with the errors it gave after the update, but I'd just restart the game; however, a few hours ago it crashed and it would refuse to close even with terminate process in task manager. I restarted my pc and opened the client and as soon as Gameguard popped open I got a windows error and my whole system crashed; tried again, same thing, it's insane this trash can harm my whole system on top of being invasive and doing nothing. 

 

I would honestly not run GameGuard. If you read the post I linked to that links to three other posts, it talks about the serious harm it can have on your system.

 

Quote

 

Next, a post on it that links to 3 other threads about it -> http://www.clylla.com/forum/showthread.php?687-GameGuard-is-Safe-Right-Think-Again!

 

 

GameGuard can potentially corrupt your Operating System. It is very scary and very serious.

 

[Profyrion]

1 hour ago, Zel said:

As an IT Admin, the only difference between GameGuard and Malware, is that companies pay for GameGuard.

As an IT Admin, the other difference is that malware breaks things intentionally while GameGuard only breaks them out of sheer incompetence and an overzealous attempt at "security".

 

[xFragileDreamsx]

Thanks for the information. I was wondering why there was so much hate on Game Guard. Why so many people kept crashing. Now I know. :/ Kind of makes me wanna drop Blade & Soul myself.

[se]

5 minutes ago, nestharus said:

 

I would honestly not run GameGuard. If you read the post I linked to that links to three other posts, it talks about the serious harm it can have on your system.

 

 

Yes, I know, and I had actively avoided games that had been using it for 3 or 4 years now; however, I was super excited and looking forward to play this game for years, since it was first announced in South Korea, so I thought I'd just try it out. 

I'm very torn as to what I should do, I really want to play but at the same time, it's not worth it, I feel. 

I know in other games players petitioned the NA publishing company to take it out of the game version they hosted and they obliged, in the end, I hope maybe the staff here might be persuaded as well if we did something like that. 

[NN13]

59 minutes ago, LilithDragonFlower said:

 

. What I do know for sure is that with (Game Guard) on my system before I removed this along with "XingCode3" I had problems running other games and services not related to games that required "Game Guard" because of the way Game Guard scans memory, and was doing something to my network causing packets to arrive somewhat out of order, causing performance issues in more than one way.

 

 

This might explain the packet losses I have been experiencing. I never had this kind of packet loss. I asked my ISP to check if there was a problem and they didn't find one. A few days ago, I realised the packet problem started only after I played Blade and Soul for an hour or so. I thought that BnS might be hoging my network so I simply logged out of the game, waited for sometime and played again.

I think now I am going to just uninstall this game. Its not worth it, having a rootkit and a keylogger just for playing a game riddled with bots and gold-sellers.

 

Thank you very much OP, for the information.

[nestharus]

Everyone, if you haven't read the thread I linked to that I have now underlined, the information contained in it and the stuff it links to is pretty important, especially #1 and #2. They talk in-depth about what GameGuard does.

 

This is the link from the first post -> http://www.clylla.com/forum/showthread.php?687-GameGuard-is-Safe-Right-Think-Again!

 

Again, there are three links in that thread. Read atleast the first 2. The first one is long. The second is short.

 

I highly encourage that these be read so that it can be understood how scary GameGuard is. It hijacks your entire computer.

 

3 minutes ago, NN13 said:

This might explain the packet losses I have been experiencing. I never had this kind of packet loss. I asked my ISP to check if there was a problem and they didn't find one. A few days ago, I realised the packet problem started only after I played Blade and Soul for an hour or so. I thought that BnS might be hoging my network so I simply logged out of the game, waited for sometime and played again.

I think now I am going to just uninstall this game. Its not worth it, having a rootkit and a keylogger just for playing a game riddled with bots and gold-sellers.

 

Thank you very much OP, for the information.

 

fyi, uninstalling Blade & Soul will not remove GameGuard.

[NN13]

5 minutes ago, nestharus said:

Everyone, if you haven't read the thread I linked to that I have now underlined, the information contained in it and the stuff it links to is pretty important, especially #1 and #2. They talk in-depth about what GameGuard does.

 

This is the link from the first post -> http://www.clylla.com/forum/showthread.php?687-GameGuard-is-Safe-Right-Think-Again!

 

Again, there are three links in that thread. Read atleast the first 2. The first one is long. The second is short.

 

I highly encourage that these be read so that it can be understood how scary GameGuard is. It hijacks your entire computer.

 

 

fyi, uninstalling Blade & Soul will not remove GameGuard.

Ya, got the info on how to remove GG thanks to the link. Won't be a problem for me. =)

[Profyrion]

7 minutes ago, nestharus said:

Everyone, if you haven't read the thread I linked to that I have now underlined, the information contained in it and the stuff it links to is pretty important, especially #1 and #2. They talk in-depth about what GameGuard does.

 

This is the link from the first post -> http://www.clylla.com/forum/showthread.php?687-GameGuard-is-Safe-Right-Think-Again!

 

Again, there are three links in that thread. Read atleast the first 2. The first one is long. The second is short.

 

I highly encourage that these be read so that it can be understood how scary GameGuard is. It hijacks your entire computer.

 

 

fyi, uninstalling Blade & Soul will not remove GameGuard.

I'd recommend GMER for finding & removing it if it doesn't uninstall cleanly (or just to be sure).

 

http://www.gmer.net/

 

[se]

47 minutes ago, Profyrion said:

I'd recommend GMER for finding & removing it if it doesn't uninstall cleanly (or just to be sure).

 

http://www.gmer.net/

 

Oh, thanks, will that program reliably remove it from every nook and cranny it invaded? I'm not very savvy into complex processes like described in the previous link to use commands and such. 

[nestharus]

7 minutes ago, se said:

Oh, thanks, will that program reliably remove it from every nook and cranny it invaded? I'm not very savvy into complex processes like described in the previous link to use commands and such. 

 

It should. You can post what it removed for us computer scientists and IT people to double check if ya want.

 

You can remove GameGuard and keep Blade & Soul if you want. You won't be able to play it while GameGuard is active, but once they deactivate it, it should work again. Best of both worlds : ). Some people on this thread have already done that and are just waiting on NC Soft.