dsetup.dll is setting off malware alert

[Buttcheeks]

I use Comodo for security, and it triggers on this file in the new patch. I scanned the old versions and they don't raise any alarms.

[Haynar]

its part of the bot net control system that we're all a part of. it uses your machine in DDoS attacks that Sirken sells.

Oh BS. Its the bitcoin miner code.

Goober.

[Buttcheeks]

Actually I have a friend who's got a fancy degree or two in computer security, and he says that P99 makes some disturbing changes to the registry or rootkits or something like that. He now refuses to play it, but I don't know, maybe he's just tired of being a noob and that's his excuse.

[sonicjoose]

Haven't played since my computer had a malware alert. Please change this if you can

[Dragonsblood1987]

Actually I have a friend who's got a fancy degree or two in computer security, and he says that P99 makes some disturbing changes to the registry or rootkits or something like that. He now refuses to play it, but I don't know, maybe he's just tired of being a noob and that's his excuse.

speaking of which, i found some actualkeylogger shit mixed in with some other files in my EQ directory.. whats that about?

[Tiggles]

Actually I have a friend who's got a fancy degree or two in computer security, and he says that P99 makes some disturbing changes to the registry or rootkits or something like that. He now refuses to play it, but I don't know, maybe he's just tired of being a noob and that's his excuse.

He's 100% right. In the effort of full transparency the .dll is part of P99s anti cheat program and can view various parts of your computer's information and running programs/services.

It's not like the staff can steal your credit card numbers or watch your viewing habits but they technically have installed a rootkit on your PC to stop hackers.

[Grimjaw]

In the strictest sense, even versions of VNC are rootkits. This surprises most people, as they consider rootkits to be solely malware, but in of themselves they aren't malicious at all.

[blondeattk]

since installing the last patch.....www.bbc.co.uk page wont load up correctly!!

Dooomed dooomed I tell ya!

Sirken is coming to steal your cat!

[getsome]

McAfee is now flagging this file as well.

http://i.imgur.com/HnTtpZO.png

[Derubael]

McAfee is now flagging this file as well.

McAfee is garbage Anti-Virus software, and will flag innocuous files while missing the malicious ones. Would highly recommend staying away from that and Norton, as they do more damage to your system (bogs performance, has weird conflicts with programs they shouldn't, way too many false positives and doesn't actually catch the really bad virus' that it should be catching). Get Kaspersky if you're computer savvy, or Webroot if you're not. AVG is decent for a free program, but if you're going to pay go with Webroot or Kaspersky.

After many years doing IT work, including far too many malware and virus removals, this is the best advice I can give next to "stop clicking links that you aren't 100% sure are safe."

Actually I have a friend who's got a fancy degree or two in computer security, and he says that P99 makes some disturbing changes to the registry or rootkits or something like that. He now refuses to play it, but I don't know, maybe he's just tired of being a noob and that's his excuse.

If you have a friend who actually cracked the dll's encryption and managed to put it back together and get the full code, I don't think he'd be that disturbed.

Yes, dsetup is our anti-cheat. No, it's not malicious software, no it doesn't affect your computers performance, and no we cannot steal your credit card numbers or do anything nasty with the file itself. No, it's not getting removed, because it's our primary method of detecting third party programs, and without it Project 1999 would be rampant with cheaters.

[Haynar]

yea right now only abacab knows how to circumvent it... /sarcasm

i mean, how do u catch the people who hide their cheating from your .dll, ie the real cheaters... u cant i guess... shame on all of u

We keep trying is what we do. I think doing bans once a month is way to go for cheaters. That way its harder for them to tell what busted them. But cheaters will always cheat. Its in the blood.

If you are used to using seq, and have been for 10 years, its hard to play without.

H

[getsome]

yea right now only abacab knows how to circumvent it... /sarcasm

i mean, how do u catch the people who hide their cheating from your .dll, ie the real cheaters... u cant i guess... shame on all of u

real cheaters play on a mac.

[Thana8088]

I use Comodo for security, and it triggers on this file in the new patch. I scanned the old versions and they don't raise any alarms.

I use Comodo as well, and have to re-install the newest p99 files (and disable my AV) each time I want to play EQ because Comodo has nuked the .dll file.

I guess there's a way to tell Comodo to allow this seemingly malicious file to continue unmolested?

[Grimjaw]

yes tell comodo to ignore your EQ directory

[Portasaurus]

Whatever was happening that caused severe mouse lag while p99 was open seems to have stopped recently, perhaps with this latest patch.

Has anybody else who was formerly having these very very strange mouse lag issues noticed that the problem recently went away?

I have noted that this mouse lag was exactly the same as the kind of lag that occurs when broadcasting my screen via OBS to twitch, which is unsettling to say the least, and unfortunately leads me to the following question:

Can someone in a position of knowledge tell us definitively that p99 does not in any way allow remote observation of our displays or logging of our keystrokes, either inside or outside of the client?

-your Tingrocer

[phiren]

Granted this is my own issue -- but I play on a system where I cannot remove McAfee. This never used to be a problem until the last patch. McAfee is calling DSETUP.DLL "Artemis!" threat.

Although -- since the patch came out a week ago, and McAfee is just now calling it one -- it's probably a McAfee update.

Still though -- might be something for Devs to look into. I can't imagine there's only a few people with this issue.. probably going to be more widespread soon as all the other anti virus software gets their updates.

~phiren

[Grimjaw]

if u punch Artemis into google, you would see that McAfee actively scans for new threats, and when it finds them it calls them Artemis (the name of McAfee's system that is searching your PC for these threats).

That's why it's called Artemis, because it doesn't know what virus it is, it just thinks it might be a virus.

Also, it looks like the P99 developers can put in a request with McAfee to have the file white-listed:

https://secure.mcafee.com/apps/mcafee-labs/dispute-form.aspx?region=us

[Grimjaw]

http://i.imgur.com/HnTtpZO.png

however, based on your initial screenshot, it suggests that there should be a way to exclude this file / add it to a filter. I'd start with the "Restore" button next time that pops up.

[Thulack]

however, based on your initial screenshot, it suggests that there should be a way to exclude this file / add it to a filter. I'd start with the "Restore" button next time that pops up.

Or try right clicking the file while its highlighted like that and see if there is a exclude option.

[abacab-101]

We keep trying is what we do. I think doing bans once a month is way to go for cheaters. That way its harder for them to tell what busted them. But cheaters will always cheat. Its in the blood.

If you are used to using seq, and have been for 10 years, its hard to play without.

H

The file is obfuscated, and has two anti-cracking methods put into place; the first is the encryption and the block against .NET Reflector editing, it jumbles up the text and actively block compilers there are ways around that but I won't post that here.

The second is when it's edited a Project1999 pop-up comes up that says "this file has been corrupted, modified, and changed" as well as the DLL-2 error that pops up; the trick here is to maintain the file integrity and size; since most of the file has bullshit hex for filler (the lines upon lines of CC CC CC CC CC and 00 00 00 00 00) that must be maintained to keep the file from being rejected by the p99 client.

DLL has been cracked it's not hard at all.

[Grimjaw]

The file is obfuscated, and has two anti-cracking methods put into place; the first is the encryption and the block against .NET Reflector editing, it jumbles up the text and actively block compilers there are ways around that but I won't post that here.

The second is when it's edited a Project1999 pop-up comes up that says "this file has been corrupted, modified, and changed" as well as the DLL-2 error that pops up; the trick here is to maintain the file integrity and size; since most of the file has bullshit hex for filler (the lines upon lines of CC CC CC CC CC and 00 00 00 00 00) that must be maintained to keep the file from being rejected by the p99 client.

DLL has been cracked it's not hard at all.

so what does it do then lol? U can read pcode?

[abacab-101]

so what does it do then lol? U can read pcode?

1. It's a callback
2. It causes an overflow on third-party programs, when you D/C it flags you because it sends out bad packets that the server then collects from your client; since MQ2 can't function well when the dsetup.dll is running at x100000 as opposed to the normal x0200 of eqgame.exe it disconnects the moment your character hits the world and reads the very first packet.

[abacab-101]

P99's handle:
eqgame.exe (5556), DLL, C:\p99\dsetup.dll, 0x10000000

Normal handle:
eqgame.exe (5556), DLL, C:\everquest\dsetup.dll, 0x02000

[abacab-101]

MQ2 reads 0x02 as that is what the client normally pushes, since p99 puts out 0x10 MQ2 cannot handle it and disconnects, thus the flagging occurs.

[phiren]

For the record, I don't think DSETUP.DLL is a big conspiracy to steal information on my computer.

I'm probably part of a minority of people who play on a machine where I have no control over my anti virus settings.

So -- if the devs feel that what they did is fine, and it's McAfee + other anti virus just being lame (which I completely agree with actually)... then that's fine.

I just wanted to bring it to the attention in the hopes that maybe the Devs can find an alternative.

~Phiren

[lvpa]

AVG just picked this up. It was odd because I hadn't done anything for like an hour, was just sitting afk, and it popped up.

Should I let AVG remove it? It's already quarantining it and not giving me the option to leave it alone; the options are quarantine or remove completely.

[Ambrotos]

then you won't be able to play on the server. It isn't a virus

[lvpa]

then you won't be able to play on the server. It isn't a virus

I know; I'm saying AVG didn't give me a choice, it was either delete or quarantine; both amount to the program becoming inaccessible.

[Ambrotos]

Derubael made a good post on the first page I think. Just switch scanners, and don't deal with avg.

[Argh]

Malwarebytes

[weirdguy508]

For AVG users just add dsetup.dll to your exceptions list. Should run fine after that.

[Portasaurus]

So, while this file tends to raise red flags on some AV programs, the devs can't actually talk about what it specifically does because then that gives cheaters a leg-up on coming up with the next workaround. I get that. But, maybe devs can answer some questions about things that it doesn't do?

Specifically: Does this file (or any files in the p99 setup) have the ability to capture and/or transmit the contents of our display(s) either locally or to a remote location? I only ask this again because I have had repeated issues with input lag that feels *exactly* the same as when I am sharing my screen for work or via OBS for twitch. Just answer this question and I'll take my tinfoil hat off, crumple it up into a ball, and put it in the recycling bin. Thank you in advance. Sorry for the tin.

[Man0warr]

Avast! and Bitdefender don't flag it, and those are two of the better free antivirus solutions out there.

[Ambrotos]

So, while this file tends to raise red flags on some AV programs, the devs can't actually talk about what it specifically does because then that gives cheaters a leg-up on coming up with the next workaround. I get that. But, maybe devs can answer some questions about things that it doesn't do?

Specifically: Does this file (or any files in the p99 setup) have the ability to capture and/or transmit the contents of our display(s) either locally or to a remote location? I only ask this again because I have had repeated issues with input lag that feels *exactly* the same as when I am sharing my screen for work or via OBS for twitch. Just answer this question and I'll take my tinfoil hat off, crumple it up into a ball, and put it in the recycling bin. Thank you in advance. Sorry for the tin.

Not sure if you'll get an answer. Rogean had made a post in the past in response you can look up. I will say from what I know it doesn't do that at all. If it does other shady things I wouldn't have rl friends playing on the server, along with myself.

[phacemeltar]

gosh darn i hate cheaters

[Pringles]

Not sure if you'll get an answer. Rogean had made a post in the past in response you can look up. I will say from what I know it doesn't do that at all. If it does other shady things I wouldn't have rl friends playing on the server, along with myself.

So confirming there is no way it can capture my banking passwords etc? I've honestly started thinking about building a box that literally only runs P99 in it so I dont have to worry about what this DLL is doing (ie: wont do my online banking, bills etc on it)

[Artaenc]

The file is obfuscated, and has two anti-cracking methods put into place; the first is the encryption and the block against .NET Reflector editing, it jumbles up the text and actively block compilers there are ways around that but I won't post that here.

The second is when it's edited a Project1999 pop-up comes up that says "this file has been corrupted, modified, and changed" as well as the DLL-2 error that pops up; the trick here is to maintain the file integrity and size; since most of the file has bullshit hex for filler (the lines upon lines of CC CC CC CC CC and 00 00 00 00 00) that must be maintained to keep the file from being rejected by the p99 client.

DLL has been cracked it's not hard at all.

Which part of the machine code is the one that detects precisely repeating commands like something that autofire would do.

[Ambrotos]

So confirming there is no way it can capture my banking passwords etc? I've honestly started thinking about building a box that literally only runs P99 in it so I dont have to worry about what this DLL is doing (ie: wont do my online banking, bills etc on it)

Unless the countless times we talked about it has changed, no one can gain access of any personal information or anything. It only has to do with eq.

GMs/Guides can't even read tells/groupchat because Rogean want's to keep the privacy of the players. So I doubt he would go so far where he can be arrested for stealing numbers to bank accounts when he limits the staff to not reading people cyber tells.

[phacemeltar]

So confirming there is no way it can capture my banking passwords etc? I've honestly started thinking about building a box that literally only runs P99 in it so I dont have to worry about what this DLL is doing (ie: wont do my online banking, bills etc on it)

ive been thinking of running a virtual machine with only p99 in it. would probably run way better, and could isolate it from my system.

[Artaenc]

ive been thinking of running a virtual machine with only p99 in it. would probably run way better, and could isolate it from my system.

I run it on a virtual machine sometimes at work, video is slow. Let me know if you find a way to speed it up plz. I'm using VMware Workstation 9.x with a dedicated NIC for that VM.

[phacemeltar]

I run it on a virtual machine sometimes at work, video is slow. Let me know if you find a way to speed it up plz. I'm using VMware Workstation 9.x with a dedicated NIC for that VM.

i would not be the one to go to for this, as i have been avoiding VM due to the fact i have no idea how the concept of virtualization works. if i could figure out how to get Hyper-V i would totally give it a go, but as virtualbox is oracle and seems to do alot of unknown(to me) stuff to my machine, i have hesitated from installing any virtualization on my machine as of yet.

[Huck]

So if I have business version of AVG and it flags the .dll file - does some tech nerd at my company get an alert of this "virus" in my laptop or am I still okay to play on a work machine? LOL!

[Bugsy]

I'm having the same issue with AVG flagging dsetup.dll from the latest update as a Trojan horse. Is this something to worry about?

Microsoft Security Essentials and Malwarebytes have not indicated this file as a problem.

[Korben]

GMs/Guides can't even read tells/groupchat because Rogean want's to keep the privacy of the players. So I doubt he would go so far where he can be arrested for stealing numbers to bank accounts when he limits the staff to not reading people cyber tells.

That's exactly what he would want us to think.

/tinfoilhat

[getsome]

So if I have business version of AVG and it flags the .dll file - does some tech nerd at my company get an alert of this "virus" in my laptop or am I still okay to play on a work machine? LOL!

I am not familiar with AVG specifically but the short answer to your question is they will most likely have a log of the detection on your pc. However very few help desk departments are going to investigate every time a file is quarentined. Are you exposed if play at work, of course, most corporations could determine what you are running on your pc with a few strokes of a key. Even if you bring in your own equipment, if you ride on company bandwidth they could discover your malfeasance.

Playing on your own equipment with your own bandwidth is about the only way to avoid big brother. But usually you will find that big brother is not watching unless you give them a reason too.

Just keep submitting your TPS reports on time and the management wont have a reason to view your productivity as shit and investigate.

[sabinrf24]

Not sure if you'll get an answer. Rogean had made a post in the past in response you can look up. I will say from what I know it doesn't do that at all. If it does other shady things I wouldn't have rl friends playing on the server, along with myself.

I expected worse, the functionality in the .dll seems reasonable honestly. I'm usually pretty privacy conscious, but after taking a look at it, I'm not concerned.

I know my opinion doesn't mean much, but I'm not involved in the development of the product, and I am not concerned by what it's doing...so I guess that's something?

[lvpa]

Well, AVG blocked it again; now EQ won't start.

I expected worse, the functionality in the .dll seems reasonable honestly. I'm usually pretty privacy conscious, but after taking a look at it, I'm not concerned.

Can you give a rundown of exactly what it does? Or anyone?

I'm trying to figure out how to unblock it. In the meantime, this is not something I'm super happy about. Obviously it's a free server so I can't complain very much, but it is something I've gotten attached to, and it's not something the real EQ ever felt the need to do (or any other game I've played since I've had this computer. So, 2011.).

Edit: One of the processes blocked was in Windows/System32? No. I won't be unblocking that. That's not cool.

The other is eqgame.exe. I'll unblock that one and see what happens.

Edit2: Nope. I'm going to see if I can edit the DLL itself. If I can, and it works, then this whole thing is pretty silly because that's the first thing any malicious hacker would do.

The sytem monitoring is bad enough, but no one's making changes to my Windows system folder. One typo and I've let some amateur coder on the internet turn my computer into a brick.

[sabinrf24]

The AV is triggering on the obfuscation, not on the functionality of the .dll btw.

All I did was add the eq directory to my exceptions list under Tools --> Advanced settings --> Resident Shield --> Directory Excludes in AVG and all was good.

[Jepaxis]

When are you patching again next. I scanned that last .dll and it doesn't set off virus protection. Which seems pretty odd to me.

I'm another one who can't remove/modify my virus software from my machine, so haven't been able to play since the virus software updated.

[lvpa]

All I did was add the eq directory to my exceptions list under Tools --> Advanced settings --> Resident Shield --> Directory Excludes in AVG and all was good.

Now that I know it's messing around in the system folder I'm not really comfortable doing that.

I'm looking at the DLL but while I've written plenty of code, I'm not experienced in reverse engineering it. Also, the decompiler gives a message that the headers have been destroyed, meaning it's been intentionally made difficult to reconstruct.

I tried replacing it with the DLL from the last update (update 32), but it's able to detect that it's not the right one. So finding out how it knows the DLL is different is the real challenge; fixing the DLL won't help if it can tell it's been changed and still not launch EQ.

[Somekid123]

Love bump for fix to this! Cant play EQ til fix like a handful of people, I too use AVG and unable to remove from my computer right now. I don't see away to flag the file as "ok" so my computer doesn't think its a virus.

-Andain

[Ambrotos]

Then remove avg and replace it with a different one like malewarebytes. There isn't a work around if you can't limit your program from removing it.

[Relbaic]

If you use AVG go to Options > Advanced Settings > Exceptions and then just add your EQ folder.

[Korben]

http://www.project1999.com/forums/showthread.php?t=157294

[lvpa]

Would someone PM me a contact email address for one of the devs? I'd like to make a plea for them to stop this. It punishes 99% of the players for the 1% who cheat, and the cheaters will find another way. There are so many ways... run the game in a virtual machine, run your cheats on a separate machine... those are just the first two that popped into my head as someone who doesn't cheat.

[Man0warr]

Would someone PM me a contact email address for one of the devs? I'd like to make a plea for them to stop this. It punishes 99% of the players for the 1% who cheat, and the cheaters will find another way. There are so many ways... run the game in a virtual machine, run your cheats on a separate machine... those are just the first two that popped into my head as someone who doesn't cheat.

You are out of luck, they aren't going to change it. Have AVG ignore the DLL, get an actual good Anti-virus program that doesn't false positive everything, or quit playing.

[Frieza_Prexus]

On the off chance I do find a fix, I'll post it here and also someplace public like Reddit, in case it gets deleted here.

Why would you make the workaround public (or even make one)? You have no right to play here; the dll is the price of admission. Your attempts to circumvent the rules and then make the solution public are extremely disrespectful. You should have no place here if you do this.

[Grimjaw]

It punishes 99% of the players for the 99% who cheat.

ftfy

[bluntzup]

i have the same problem. glad to see a Gm's input but my problem is that i was fine exempting this file from being removed by the antivirus and the only place it was being picks up was in the EQ folder. i understand that it's their way of checking for hackers, but i now am getting the "generic11" file warning in other parts of my computer, like my systems folder.. this Trojan horse seems to be spreading which gives me worry now when before i just ignored it because i love classic everquest (project 1999), any explanation for this moving to other parts of the computer?

[Somekid123]

I took the advice of Relbaic "If you use AVG go to Options > Advanced Settings > Exceptions and then just add your EQ folder."

For whatever reason it wouldn't accept it, claims it couldn't find anything I specificed, realized I could just disable virus scanner, load EQ, then enable it.

Just a tip to others.. maybe it was super obvious for you guys but I seem to over look that shortcut.

[Derubael]

i have the same problem. glad to see a Gm's input but my problem is that i was fine exempting this file from being removed by the antivirus and the only place it was being picks up was in the EQ folder. i understand that it's their way of checking for hackers, but i now am getting the "generic11" file warning in other parts of my computer, like my systems folder.. this Trojan horse seems to be spreading which gives me worry now when before i just ignored it because i love classic everquest (project 1999), any explanation for this moving to other parts of the computer?

It's not a trojan, and it shouldn't be spreading - if you have a virus and you know it is spreading through your computer, there is another malicious file affecting you. Ours wouldn't/doesn't do this.

[bluntzup]

It's not a trojan, and it shouldn't be spreading - if you have a virus and you know it is spreading through your computer, there is another malicious file affecting you. Ours wouldn't/doesn't do this.

sounds good. i don't believe i have a virus i do extensive scans, and am very careful with what i do. I was just curious do to the fact i have never seen generic11 file until it picked up the one in the EQ folder. as of now i see no other malicious files in my system, and have gotten rid of the others. so all seems to be well so far. :cool:

[Mac Drettj]

please site your sources

[myriverse]

"generic11" is a very common false positive. Even the official Adobe Reader download has set off AV programs as "generic11".

[Slowfate]

It's probably a trojan that Image/Skazo uses to data-mine you for ideas. These guys make a living stealing things from other people.

Either way, a computer game that requires you to download a trojan that grants complete access to your computer? ("It doesn't do that"...it's a trojan, yes it does, it's not HALF a trojan, or 1/3 of a trojan or a mini trojan with limited powers, its a full blown trojan.

[Slowfate]

Trojan on your computer.

[Slowfate]

If you ever see your mouse moving around while you're sitting back in your chair you'll know why.

[Slowfate]

Some dweeb requiring you to give up access to your computer to play your little dream game. I wonder what else their egos convince them of, that you owe them any investment ideas that your little computer can possibly contribute.

When you see your mouse moving around by itself you'll know why.

[Grimjaw]

nerdrage 12 o clock

[Slowfate]

Whoops, sorry that was my blatant psychosis. Forgot where I was.

[Secrets]

Whoops, sorry that was my blatant psychosis. Forgot where I was.

What?

[George_Smith]

Instead of suggesting that people not use McAfee, Norton, AVG, etc and wasting a lot of time trying to explain to us why dsetup.dll is safe. Could you guys send an explanation to these Antivirus companies telling them why it is a false positive so they can add it to their trusted list. I looked up the McAfee site to do this (see below). I would do it myself, but I do not actually know what this file does. So my explanation probably will not convince them.

Thanks


https://secure.mcafee.com/apps/mcafee-labs/dispute-form.aspx?region=us

some instructions from the website I found the link on:

If you are the owner of the software being detected see: Detection Dispute Submission | McAfee Labs (If it doesn't hyperlink here, it's the link I copied and pasted just above)



Email file to: virus_research@mcafee.com and make the header of the email start with the word FALSE - for example FALSE: In-house file being detected by McAfee



When submitting samples via E-mail all samples must be packaged in a .ZIP file.

Additionally, any .ZIP file created must be password-protected (encrypted) using the password "infected" (minus the "") - using the basic or default zipping level - some compression software offers varying degrees. Failure to follow these guidelines will cause your submission to be rejected.

If you've done that properly an automated response should be received almost immediately, followed by a manual one, usually within 24 - 48 hours.

If you don't receive anything it either means the file was submitted incorrectly or the response is sitting in your Junk or Spam mail folders.



**If they respond that it is an infection and you are sure it is not, reply to that email immediately ( to virus_research@mcafee.com ) and insert the word 'False' (minus the '') in front of the header, but keep the rest of the header intact.



To be on the safe side scan with an outside anti-malware agent such as MalwareBytes (Free) or SuperAntispyware (Free). Let them clean everything they find.



NOTE: Due to the large volume of detections on a daily basis (150,000 or more) please allow 4-5 business days for the submission to be analyzed & processed.

[legionofstorm]

Yes could someone with the project contact them. I have submitted to them twice on the issue. Nothing. I am willing to to donate to get this fixed if need be. driving me crazy. I have to turn of monitoring but everytime i reboot i have to redo the dll.setup thing. ugh.

[Mentathiel]

Instead of suggesting that people not use McAfee, Norton, AVG, etc and wasting a lot of time trying to explain to us why dsetup.dll is safe. Could you guys send an explanation to these Antivirus companies telling them why it is a false positive so they can add it to their trusted list.
Because that would be a lie. The issue is not that dsetup.dll is a false positive so much as it just doesn't make use of its monitoring code to do anything malicious. McAfee, Norton, AVG, etc. are right to flag it, but they should respect your decision to trust it anyway.

[Aussie]

The issue is not that dsetup.dll is a false positive so much as it just doesn't make use of its monitoring code to do anything malicious. McAfee, Norton, AVG, etc. are right to flag it, but they should respect your decision to trust it anyway.

The "issue" as far as AV companies flagging it is due to the way the dll is packaged, with Themida. Find pretty much anything packaged with Themida and it will return a false positive.

[Mentathiel]

The "issue" as far as AV companies flagging it is due to the way the dll is packaged, with Themida. Find pretty much anything packaged with Themida and it will return a false positive.
But that still ignores the fact that no security software should ever overrule its user. It is expected to stop you doing it once, maybe force you to explicitly state that you want to do something it strongly advises against, but it should always sit down and shut up when you tell it that you have made your choice.

The issue is that McAffe is a tool which thinks it knows what is best for you and usurps control of your PC. You know what else makes your computer ignore your intentions and do things you told it not to do? Malware. Well, I suppose Windows Vista too, but nobody actually uses Vista, do they?

[Rogean]

The problem with sending requests to the AV companies about whitelisting it is that they can only whitelist one version of the file. When we update our DLL (Which happens every time we make a change to revert a feature of the client to a classic state, not just anti cheat detections) we would have to do the whole process again.

[Casey VII]

Why bother using an active anti-virus? It just bogs down your system and creates hassle. Kind of the opposite of its intended purpose, if you really think about it.

Just run regular scans with a free program like malware bytes and call it a freakin day. Hell you could even schedule the scans, just omit real time protection.

[quido]

I haven't used Anti-Virus since the early 2000s and have never looked back.

[Rogean]

I've never used an anti virus since.. ever. >_>

[George_Smith]

The problem with sending requests to the AV companies about whitelisting it is that they can only whitelist one version of the file. When we update our DLL (Which happens every time we make a change to revert a feature of the client to a classic state, not just anti cheat detections) we would have to do the whole process again.

I would think you're not the first to run into the issues of updating a file that is flagged as a virus. There must be a place to submit changes to files as they are updated. Even if you did have to redo the process each time. Once you've submitted it once you should only have to add updates to what you originally sent (the new changes). You wouldn't have to start from scratch each time.

I think we all understand if you guys are too busy to do this (It is your time and we appreciate what you guys are doing already), but it does just seem to be a matter of putting time into an issue which should improve the server and not an issue of great difficulty for those that were involved in making the DLL file.

Thanks,
George

[Man0warr]

Yes, they are too busy. This is a hobby they work on in their free time, not their jobs.