Regarding Rootkit Ant-Cheats

https://areweanticheatyet.com/ - A great resource for checking games, this curator doesn't have everything!

"A rootkit is a collection of computer software, typically malicious, designed to enable access to a computer or areas of its software that would not otherwise be allowed and often masks its existence or the existence of other software."

Many online games are using anti-cheat programs that act like spyware and pose a big risk to your computer's security (as shown with Genshin Impact's Anti-cheat being used as a vector for ransomware[www.trendmicro.com]), and is a huge breach of privacy. These anti-cheats are installed with the games, usually without your permission, and when running, act like spyware by logging your keystrokes and scanning your active processes. What makes them rootkits is the fact they all act with admin permission, meaning they can terminate processes, write and read files, and do just about anything you can do.

These programs sometimes aren't always uninstalled with the game and can remain on your system.

XIGNCODE3:

- Remove by deleting the game and this file: C:/Windows/xhunter1.sys

- The xhunter1.sys service is hidden because it is installed on a kernel level.
- XIGNCODE3 is a keylogger.
- XIGNCODE3 can see every file you have accessed within the last 48 hours, including the filepaths.

nProtect GameGuard

-Remove by deleting the game, and nppt9x.vxd & npptNT2.sys in either C:/Windows/System32 or C:/Windows/SysWOW64

-GameGuard is a keylogger.
-It monitors the entire memory range
-Can terminate processes defined by the developer

Wikipedia article on GameGuard[en.wikipedia.org]

Easy Anti-cheat

(from Zullfix's review of VRChat)

What EAC has done in the present/past:

- Take routine snapshots of the user's desktop/video buffer

- Scan all processes running on user's machines

- Kill or try to kill all "unknown" or "untrusted" or "unregistered" running processes (including homemade processes)

- Locate the files of "unknown" or "untrusted" or "unregistered" processes and upload them to Epic's servers

- Scan the user's C:\Users\ folder and appdata folder

- Stop users from launching the game if Windows fails to install/update itself "correctly" (google "easyanticheat UNEXPECTED-KERNEL-MODE-TRAP", though epic tries to censor this issue)

- Stop device drivers that are "unknown" or "untrusted" or "unregistered" from running (including homemade drivers)

FACEIT

Did some research and found this, it is using a kernel-level driver, requires certain BIOS settings and requires you to disable Hyper-V, so I'd stay far away from it, that's very intrusive.

https://support.faceit.com/hc/en-us/articles/9394666828188-What-is-FACEIT-Anti-cheat-and-how-does-it-work-

VIEW ALL

POPULAR DISCUSSIONS

VIEW ALL (1)

RECENT ANNOUNCEMENTS

Genshin Impact uses an invasive anti-cheat.

6 October, 2020 - Magpie | 2 Comments

I found out last night that Genshin Impact uses an invasive anti-cheat and installs a kernel-level driver as part of it. Previously, this anti-cheat would remain open on your computer until shutdown, but when they were caught and users complained, they changed it so it closed when the game closed. It is however, still a kernel-level driver installed without consent.

Uninstalling the game may remove it, but the installer removes only the folder with the .exe of the game, so you'll need to manually navigate to the root and delete the whole thing yourself. I'm currently checking to see if it's hidden anything on my PC, though I'm not a professional.

The anticheat is called mhyprot2.

VIEW ALL (545)

STEAM CURATOR

Rootkit Anti-Cheats reviews

"Games that use dangerous rootkits as a form of anti-hack. They are essentially malware/spyware and are a serious security threat. Even if they don't directly do harm, they leave a backdoor for malicious software."

Here are a few recent reviews by Rootkit Anti-Cheats

VIEW ALL

11 Comments

view all

< >

sin3to1faith 16 Sep @ 9:56am

I followed for curator reviews years ago but only now decided to join the group. It's insane how in the span of one week I've found out 'Arena Breakout: Infinite', 'Maplestory', and 'Wuthering Waves' all use different forms of Kernel Level Anti-Cheat (KLAC).

I don't know how recently steam reinforced this but I was able to simply go to a products store page and check the right side where they usually state if they have any EULA's. In that section is where they must also state if they use "regular" AC's or KLAC's.

While typing this I just realised I may as well organise my entire steam library off this feature.

🦈Da Great Magician Aike🐙 9 May @ 8:47am

We got Overwatch 2 and other hero shooters to tied us over until Netease either replaces Netease Game Security or removes it entirely. But I doubt that they will do that or we're in for a long wait. (In a semi-off topic discussion, OW2 is a bit of a downgrade, like some playable characters are locked and ya either must grind or fork over the moolah. Woe to you if you're a newcomer).