Latest update ruined functionality of some MMORPG games

[Guest]

[kail]

Gamers

We need to give the CFP Devs a little more time. This issue was reported at the weekend & if they're at work early, they're probably still staring at the coffee machine at the moment (US office time). In short, they're probably not specifically aware of this issue as yet.

[razor74]

Same happens with Cabal Online (uses Game Guard). I get BSOD them moment Game Guard loads, and for me only solution was to remove Comodo Firewall, since disabling didnt help. I attached 3 mini dump files.
My OS is Windows XP sp2
PC: AMD Athlon XP 3200+,1 GB ram

Works with D+ disabled permanently. It's the only one solution for the moment...

BTW for the mods. Gameguard incorporate a self protection for security module...
http://eng.nprotect.com/nprotect_gameguard.htm

[kail]

Since they've had a few cups of coffee by now, I sent a PM to the CFP Devs & pointed them at this topic.

[grislou]

hello

anything new ? coz i play to muonline and i had some BSOD, sadly i had to remove CFP, so now im waiting for some news..

[kail]

Hi grislou, welcome to the forums.

I don't know, I'll send another PM (Personal Message) to the Devs & try to find out the status.

[kail]

OK, the CFP Developers are painfully aware of this issue & are investigating.

However, I get impression that they are very unhappy with nProtect & its rootkit-like behavior. It actually seems to be trying to disable CFP and may have even been successful on previous versions until CFPs rootkit protection was improved in 3.0.22.349 (thus, the BSODs). But, they are actively investigating & if they find a bug in CFP, they will fix it PDQ.

I would suggest that it might be prudent for users to contact their Game vendors, advise them of this issue & get their take on it. Ignoring CFP for a moment, this nProtect GameGuard might be disabling firewall protection at will.

[egemen]

Hi Guys,

GameGuard tries to disable CFP's Defense+ and CFP tries to counterattack. During this fight, if you have another security software installed(For example AVAST!), unexpected BSODs happen. We will be fixing these BSODs with the next update(in a couple of days).

However to be able to play the games, you must permanently disable Defense+ otherwise it wont let any rootkit to disable its protection(i.e. it will activate its self defense).

To deactivate the D+ permanently

1 - Goto "Defense+->Advanced->Defense+ Settings"
2 - Select "Deactivate the D+ permanently" checkbox
3 - Press Apply and restart your PC

The games must work fine if you follow 3 steps.

However as a side note: The behavior of this game protection software is typical of a rootkit and can never be accepted as a legitimate behavior. There is no such thing as "white rootkit" in terms of CFP. CFP is an anti rootkit tool. Whether it is white, blasck, red, yellow. Unless the rootkit does not attack CFP, it wont attack the rootkit if it is allowed by the user. But this one is unfortunately attacking D+ core. 

[razor74]

Maybe you can leave this at "user level" . Every user if he/she wants - to disable (in one or another way) monitoring of this particular aplication. On the other hand , maybe it's nProtect problem, not game developers. They take and implement this "Gameguard" as a finite product, and they cannot add modifications to a software that is not  their product. For my point of view is a simpler way for comodo to implement a rule for this particular aplication, not to disable entire firewall rootkit protection. Anyway, nProtect gameguard is not a hack program - is a legitimate program, and is not the single one in this category...

BTW - i use CFP in conjunction with NOD32 antivirus (V.3)

[Rexxus]

I play Cabal Online wich also uses gameguard and when the game is about to start BAM a bsod.

This only started to hapen when i updated comodo firewall to the latest version!!

Please be fast to solve this problem !!! thanks!!

[kail]

Hi Rexxus, welcome to the forums.

The reasons & work-around are above. But, be aware - although the CFP Devs might be able to stop the actual BSOD from happening, that probably will still not allow nProtect GameGuard to disable CFPs Defense+ Rootkit protection. In short, you still might not be able to play the game without Defense+ being permanently disabled first (the current work-around).

razor74: Yes, I understand that the game developers are not directly responsible for GameGuard. I suggested contacting the game developers since they are, in effect, customers of nProtect & it would be appropriate for them to contact nProtect on this issue (they'd probably carry more weight as well) rather than you (the end-users). I may be wrong, but often in situations like this, nProtect may not even want to talk to, or acknowledge, the end-users directly.

[razor74]

And other sollution? From your side? For example - to let user to create a rule to leave gameguard to function without interfere with CFP? To be more explicit - let user to decide what can he do with his security in this case, but not to disable entire D+ . It is so difficult to resolve this problem? It's annoing to disable and restart computer every time when i want to play a MMO game. And i don't want to have a firewall partial disabled. Most users will preffere to uninstall CFP for the time when they play those games. And time it can be looong, very long. To play a MMO game it can take months, or maybe over an year... I propose this sollution because i am aware it will not be any fix (too soon) from game developers or INCA software (developers of Gameguard)...

[kail]

Hi razor74

Firstly, I'm one of you (a user), most Mods are volunteer users here. Although, I do code (infrequently these days).. I've never coded for Comodo. So, this is a personal take, not an official one..

It is so difficult to resolve this problem? Based on what Egemen has said, yes I suspect it might be. I doubt that an allowance can be made on a application by application basis, as this issue has a system-wide impact. The problem is that GameGuard is "attacking" CFP (I guess it thinks CFP is a cheat/bot or whatever) & that is provoking CFP into responding in-kind (self-defence). This, coupled with the presence of another security app, results in the unexpected BSOD. Even if CFP allows GameGuard to disable its anti-rootkit (which it cannot/must not do), then CFPs anti-rootkit protection is disabled system-wide (globally). This, for the user, is not a good thing. Additionally, CFP is probably ahead of most of the field in things like rootkit protection.. but, it's only a matter of time before GameGuard starts running foul of other security software (firewalls, AVs, HIPS, etc..).

Disabling CFPs anti-rootkit protection: I don't think this is a switch, that can be turned off and on. We're probably talking about Kernel-level hooks here. Which is probably why you need to reboot to disable Defense+.

I hope that helps or, at least, makes things a little clearer.

[razor74]

It's more clear now... I try and put a link to this discussion on Acclaim forums and maybe...

[egemen]

And other sollution? From your side? For example - to let user to create a rule to leave gameguard to function without interfere with CFP? To be more explicit - let user to decide what can he do with his security in this case, but not to disable entire D+ .

Let me be clear about what it is: It is ENTIRELY DISABLING CFP and any other security software in an illegitimate way. Never mind entirely disabling them, by unhooking, it is also endangering the OS stability. The operations it attempts are not such simple things. It is trying to disable kernel hooks set by CFP.

Your only option is to disable D+ permanently. Because there is no way to run D+ and such a rootkit in the same computer.

We can reconsider restarting requirement for disabling D+ permanently. But this does not solve anything.  Really D+ is only to protect against such things.  You should simply disable it permanently if you are OK with this fact. No other security software will be operational in anyway with those game protection hacks.

Egemen

[incar]

Hi, um excuse me, I have a very dumb question here. After disabling D+ permanently, can you bring it up again?

[Tags:]