Author Topic: avastsvc.exe problem with MMORPG Archlord Webzen (Read 7370 times)

Bennieboj · « **on:** January 09, 2011, 05:39:22 PM »

Hi everyone,

First of all I saw that other thread about avastsvc.exe, but I decided to make my own since it's a standard rule in many forums and in this way I can be more clear about my problem, errors etc...

Here's some info about my system:
I'm using Avast! Free v5.1.864. current version of updates:110109-0
Machine name: BEN-5699C5755C8
Operating System: Windows XP Home Edition (5.1, Build 2600) Service Pack 3 (2600.xpsp_sp3_gdr.100427-1636)
Language: Dutch (Regional Setting: Dutch)
System Manufacturer: System manufacturer
System Model: System Product Name
BIOS: BIOS Date: 07/28/09 13:50:19 Ver: 08.00.15
Processor: Intel(R) Core(TM) i5 CPU 750 @ 2.67GHz (4 CPUs)
Memory: 3062MB RAM (in fact 4GB, but xp only sees 3)
Page File: 684MB used, 4263MB available
Windows Dir: C:\WINDOWS
DirectX Version: DirectX 9.0c (4.09.0000.0904)
DX Setup Parameters: Not found
DxDiag Version: 5.03.2600.5512 32bit Unicode

Secondly, my problem. I play the MMORPG Archlord (made by Webzen). This game uses GameGuard to prevent hacking, macroing, botting, cheating, and stuff.

I already posted something about my problem on their forums. Normally, as said on their forums I would post here first, since this is the official Avast! forum. But since the game has a lot of bugs and errors (no need to lie about it, it's simply true) I posted there first, of course no response (yet). But now I come here and I see that there are other people who have (had) problems with avastsvc.exe.

Here's how it goes:
Whenever I start Archlord (I think since the last update of the game) I get an error message, the avast! console crashes and reboots itself within seconds and AL pops up. Then Archlord loads (abnormally fast) and closes itself (this aint strange, sometimes it simply happens, but next time it works fine and now it doesn't).

I don't expect you to download the game and try it yourself or something like that, I'd just like to know if anyone knows what might cause avastsvc.exe to crash (maybe GameGuard??).

Thanks in advance,

Bennieboj

DavidR · « **Reply #1 on:** January 09, 2011, 05:48:42 PM »

A forum search on game guard should turn up some topics as I believe there are many. But there is a pre-release build which is meant to have a fix for that included, http://forum.avast.com/index.php?topic=68927.0.

So if you are happy to download the pre-release build to see if that resolves the game guard issue, etc.

Bennieboj · « **Reply #2 on:** January 09, 2011, 06:15:20 PM »

Thanks DavidR for the fast response

I downloaded the pre-release build.
Avast! doesn't crash anymore, which is a good sign, but sadly the game doesn't stay open either.
So now it goes like this:
I open the game by clicking on a button in Firefox, I see the GameGuard logo.
Avast! doesn't crash but GameGuard closes (I think), and since GameGuard ain't open anymore the game loads and closes a second after loading.

As said, I'm not sure if GameGuard is really closed, I normally don't check the processes when I'm playing. I can still play the game on my laptop and since I don't have Avast! on that machine I can check the processes to see if GameGuard reall gets closed.

Also, sadly I won't be able to reach this machine (the one with Avast!) untill it's weekend (so 14 Jan). So I'll check the process list and I'll let you know what I found out.

So I hope the problem is fixed when I get back home, otherwise I'll let you know.

DavidR · « **Reply #3 on:** January 09, 2011, 07:06:40 PM »

You're welcome, fingers crossed.

Bennieboj · « **Reply #4 on:** January 10, 2011, 08:22:20 AM »

OK; now I'm on my laptop, I can play the game here, since I have another AV (with a 3-year license).
I've checked and compared the processes and, they're all the same.
In both process lists, I see Archlord.exe for a while, then it dissappears as a new window opens and gameguard.des and GamMon.des appear and dissappear once again. So they're the same. Sadly I can't see the real GameGuard process, since I have to know if it gets closed or not. If it does I know that's the problem, otherwise it might be blocked? I don't know how avast! handles sith GameGuard atm, but it shouldn't shut it down or block ir right?
Anyway the prcess lists are the same, so that didn't help.

As you already said, fingers crossed

DavidR · « **Reply #5 on:** January 10, 2011, 03:35:24 PM »

The problem is that the game guard process uses rootkit technology to prevent people a) seeing it is present and b) being able to disable it, etc. and this is what avast gets all excited about. So under normal circumstances you wouldn't see it using the windows API processes, e.g. explorer or task manager, etc.

If you check your C:\Documents and Settings\All Users\Application Data\Alwil Software\Avast5\report\BehaviorShield.txt (XP location), open it using notepad and see if there are any references to the game guard process/es. If so you could try adding the path given in the log (copy and paste) to the Behaviour Shield, Expert Settings, Trusted processes list and see if that resolves it.

If not then you could try uninstalling the Behaviour Shield, Windows add remove programs, avast!, click the Change/Remove button, from the next window select Change and uncheck the Behaviour Shield, OK your way out and reboot.

Bennieboj · « **Reply #6 on:** January 10, 2011, 05:37:26 PM »

OK I'll try that when I get home (and the problem isn't solved ofc ^^
Thanks for the tip, I'll let you know if it worked.

DavidR · « **Reply #7 on:** January 10, 2011, 06:25:54 PM »

You're welcome.

There is a new pre-release refresh build 5.1.884 if you want to check that out. By all accounts it shouldn't be long before this becomes a regular program update. http://forum.avast.com/index.php?topic=69152.0

Bennieboj · « **Reply #8 on:** January 15, 2011, 10:30:23 AM »

OK I'm back home.
I installed the new version (5.1.884) as a regular program update, since I wasnt able to update when it came out.
I started the game and it worked *shouts happily YAY*
I also checked my Behavior Shield file, like you asked. I found references to GameGuard like this:

Quote

8/01/2011 19:32:32 Modification of: \Device\HarddiskVolume1\WINDOWS\system32\drivers\etc\hosts
By: C:\Program Files\Webzen\Archlord\GameGuard.des
Via: C:\Program Files\Webzen\ArchLord\GameGuard.des
-> Action allowed

I guess that shows that avast! handles GameGuard well, I don't know what was wrong last week (maybe a bug in the game itself.

Anyway it works now

Thanks for you patience, help and time

Bennieboj

DavidR · « **Reply #9 on:** January 15, 2011, 03:48:24 PM »

You're welcome.

It is more likely that they have modified the detection process. The big problem with game guard is that it uses rootkit techniques to hide from the user and to protect against you modifying/removing it. Rootkits (which in most cases are malicious in intent) are just one of the things that the behaviour shield is watching out for.