RMTers discuss P1999 dsetup.dll "includes some NSA-level intrusive scans on your PC"

[Alaron01]

Originally Posted by simp403 [You must be logged in to view images. Log in or Register.]

The detection of a foreign dll and an actual process hijacking are two separate events.

I'm not sure if I agree with you. In what sense are those two events separate?

[AzzarTheGod]

Originally Posted by simp403 [You must be logged in to view images. Log in or Register.]

The detection of a foreign dll and an actual process hijacking are two separate events. Not only would the AV/anti-malware warn someone of a foreign dll, but it would also catch the process being hijacked if the dll was actually doing so. The issue you refer to lies in the former category, whereas Ostros was talking about the latter category.

I wonder what you're going to get wrong next.

Mmmhmm. Who said anything about process hijacking? Who is concerned about process hijacking?

I am concerned about process scanning. The P99 community at large is mostly concerned about process scanning.

I wonder what made up fictional concerns and strawmen distraction you are going to create next?

[simp403]

Originally Posted by AzzarTheGod [You must be logged in to view images. Log in or Register.]

Mmhmm, ASM is still not a "programming language."

An assembly language is a low-level programming language for a computer, or other programmable device, in which there is a very strong (generally one-to-one) correspondence between the language and the architecture's machine code instructions.

Originally Posted by AzzarTheGod [You must be logged in to view images. Log in or Register.]

You towed the line for Secrets, Ostros, and other smoke blowers. I centered the discussion on more transparency and you went with technicality and distraction to detract from the privacy issue.

You didn't even do that. Alaron did, long before you started spouting nonsense. However, he could actually comment on the context of the situation because he has technical knowledge, whereas you're just going full-tinfoil without any understanding of the actual topic at hand.

Originally Posted by AzzarTheGod [You must be logged in to view images. Log in or Register.]

How about the fact you demonstrated that you are completely oblivious to the AV problem? Seems you have just been posting out of your ass all this time in an effort to derail. Wondering who the ass is again?

I already responded to your point regarding the antivirus warnings about a foreign dll file. However, now we're stuck in a double-post cycle where we're responding to one another's earlier post before seeing the second.

Oh, wait, here we go:

Originally Posted by AzzarTheGod [You must be logged in to view images. Log in or Register.]

Mmmhmm. Who said anything about process hijacking? Who is concerned about process hijacking?

I am concerned about process scanning. The P99 community at large is mostly concerned about process scanning.

I wonder what made up fictional concerns and strawmen distraction you are going to create next?

Why don't you read the actual thread content? If you had followed the conversation between myself, Ostros, and Alaron, then you would have seen us discussing how swapping a dll could lead to it obtaining information on unassociated processes. This would require the code in the dll to hijack the Everquest process and inject other code into the web browser (or whatever it's trying to access). This is where the topic of process hijacking originates from.

Originally Posted by Alaron01 [You must be logged in to view images. Log in or Register.]

I'm not sure if I agree with you. In what sense are those two events separate?

The antivirus software detects a foreign dll file simply by virtue of that dll file having been modified by a third party. However, if the code in that dll file were to, say, try to grant the Everquest process administrative privileges when the program was clearly not designed to do so, wouldn't there be an additional warning or intervention by the antivirus software?

[AzzarTheGod]

Originally Posted by Alaron01 [You must be logged in to view images. Log in or Register.]

It is definitely a programming language. Most people even call it "assembly language" (see Wikipedia). In any case, this is not relevant other than to say "I know something you don't know."

Maybe in the 1980s it was appropriate to refer to assembly as a "programming language" Keyword being "programming". I never said ASM was not a language.

In 2015, I think referring to it as a programming language is not precisely accurate. I guess machine code should be referred to as a programming language according to you guys as well. To each his own, I personally won't be hearing anyone in my life or myself refer to ASM as a "programming language."

If you bring some guys in to work with ASM on a project, 9 times out of 10 they aren't doing the real programming of the project. They are there for a very narrow scope of work to help the actual programmer, but can it be said that the ASM temps are programming? I guess...I just happen to call it tech support.

I won't give ASM any acknowledgement as a programming language. Its a language, and that's it.

[Bruno]

[You must be logged in to view images. Log in or Register.]

[simp403]

Originally Posted by AzzarTheGod [You must be logged in to view images. Log in or Register.]

Maybe in the 1980s it was appropriate to refer to assembly as a "programming language" Keyword being "programming". I never said ASM was not a language.

In 2015, I think referring to it as a programming language is not precisely accurate. I guess machine code should be referred to as a programming language according to you guys as well. To each his own, I personally won't be hearing anyone in my life or myself refer to ASM as a "programming language."

If you bring some guys in to work with ASM on a project, 9 times out of 10 they aren't doing the real programming of the project. They are there for a very narrow scope of work to help the actual programmer, but can it be said that the ASM temps are programming? I guess...I just happen to call it tech support.

I won't give ASM any acknowledgement as a programming language. Its a language, and that's it.

[You must be logged in to view images. Log in or Register.]

[Magikarp]

i just wanted you all to know im filing a lawsuit for damages to my car and my gpu which was irrepairably damaged by this dll

also this stalking and constant phone calls have to stop. for the last time, i dont believe in credit card debt so please stop asking

enjoy ur sue

[AzzarTheGod]

Originally Posted by simp403 [You must be logged in to view images. Log in or Register.]

Why don't you read the actual thread content? If you had followed the conversation between myself, Ostros, and Alaron, then you would have seen us discussing how swapping a dll could lead to it obtaining information on unassociated processes. This would require the code in the dll to hijack the Everquest process and inject other code into the web browser (or whatever it's trying to access). This is where the topic of process hijacking originates from.

Mmmhmm. Are you familiar with Blizzard Entertainment's version of this type of snooping? Or SOE's that was pulled from the project back in 2001-2002 I believe.

Rather than run covertly, Blizzard has the executable "Warden.exe" run on your computer alongside Starcraft, Diablo, and WoW as well I believe (can't confirm WoW). Google warden.exe and get educated on the vast history of snooping and detection.

AV has never detected warden.exe as malicious despite the fact it is exactly similar to what SOE was trying to do in 2001-2002. So not sure what this AV argument is about, looks like another derail.

[Alaron01]

Originally Posted by simp403 [You must be logged in to view images. Log in or Register.]

The antivirus software detects a foreign dll file simply by virtue of that dll file having been modified by a third party.

I suppose it could. It would need to index and checksum every DLL on the computer... is that why it's so damn slow? I haven't read much about AVs.

Originally Posted by simp403 [You must be logged in to view images. Log in or Register.]

However, if the code in that dll file were to, say, try to grant the Everquest process administrative privileges when the program was clearly not designed to do so, wouldn't there be an additional warning or intervention by the antivirus software?

http://stackoverflow.com/questions/1...-administrativ

See Oleg's answer for one method. Would there be a warning for that? Not sure, probably depends on the AV.

[simp403]

Originally Posted by AzzarTheGod [You must be logged in to view images. Log in or Register.]

Mmmhmm. Are you familiar with Blizzard Entertainment's version of this type of snooping? Or SOE's that was pulled from the project back in 2001-2002 I believe.

Rather than run covertly, Blizzard has the executable "Warden.exe" run on your computer alongside Starcraft, Diablo, and WoW as well I believe (can't confirm WoW). Google warden.exe and get educated on the vast history of snooping and detection.

AV has never detected warden.exe as malicious despite the fact it is exactly similar to what SOE was trying to do in 2001-2002. So not sure what this AV argument is about, looks like another derail.

This is my take on the situation and how I approached this issue earlier:

Blizzard wrote the entire program. When you install one of their games, you also grant it access privileges using the host's administrative account. This means that Blizzard was capable of programming the installation procedure to request the privileges needed to bypass the protection measures afforded by the process control block in order to scan the RAM. This also means that the antivirus did not detect the scanning because that was what the program was supposed to be doing, considering that the host administrator approved the installation of the program and by extension, the capability for Warden to access the information it could.

Rogean and his crew, on the other hand, are not capable of doing this with the EverQuest Titanium client. They are only able to swap in a dll file. When the Everquest Titanium client installs, it is granted access privileges in order to run, which typically involve access to stuff like the current working directory and maybe a "my games" folder in the User's My Documents folder. If Rogean were to program some kind of malicious scanning capability into his code, it would require the eqgame process to obtain privileges outside of those granted to it at installation, which would require it to somehow access the administrative account. This is what would be detected by an antivirus program.