WSA incompatible with nProtect

Apparently online games that is using nProtect gameguard won't start if there is WSA installed. Tried tweaking and switching off the firewall and identity shield settings to no avail. Game will launch if I completely shut down webroot.

Using WSA AV 2013(v8.0.2.96) and Avira IS 2012.

 

This issue came up before and nProtect and the game had to fix it. One refused to launch based on the DLL injection WSA does to see them properly and make sure they are not misbehaving. The other just didn't recognize WSA's kernel driver and so nProtect on the game effectively had an FP, which is screwey.

Check your WSA logs and see if any parts of the game are listed with a in front of them or if there is any mention of the game process or nProtect process being monitored at level 8. If that is the case, then Webroot support can try to help.

Also, according to some sources, GG tries to inject into the keyboard filter and pukes if it can't, so if you have a browser open while playing the game, nProtect gets upset at being blocked by the ID shield. Main thing though is that GG is preventing the game from launching based on WSA being present. And not -all- games with GG have this issue. I play Aion with WSA just fine.

Which game?
Have you tried with just WSA and not Avira on there?

GG is an AV/Security utility however, so it should NOT FP on WSA and prevent game launch.

 

Thanks for the fast reply. I only saw wsa logs as in under save as scan logs,is this the logs you are referring to? The online game I am trying to get it to work is called Aika.

Update: The game still won't launch where all real time protections of avira is turned off excluding firewall. Windows firewall is disabled.

I remembered there is a compatibility issues with webroot spy sweeper and nProtect gameguard few years back which prevented online games from being launch/working that was never resolve.

 

Could you try shutting down WSA from the tray icon to see if that makes a difference?

 

Yes, those scan logs. You can save them after running a scan, or by clicking the system tools tab at the top, reports on the left, and Save As under scan logs. This saves the scan logs at the top and the full WSA logs under them. If you find items for the game or find Monitoring lines for the game, contact Webroot support to get that poked at as a temporary measure that may or may not work.

Anything related to SpySweeper must be completely discounted, as that is a 100% different code base and system. WSA is based on the Prevx engine which was a different company prior.

I was wondering about a temporary uninstall of Avira. Windows firewall + WSA is more than sufficient for protection of the system for any amount of time, so a short test run is perfectly fine too. I gather from your original message that you already tried with WSA "Shut Down". The downside is that Avira doesn't really shut down all its protection when it's not completely uninstalled, even if it claims only the firewall is on or even if the program is shut down. (This is common in security software, so is not a bad thing mind you.) If you do a temporary uninstall of Avira, be sure to record the information needed to reinstall it after testing, such as serials or key codes.

Also, since GameGuard is a security program and effectively similar to an AV itself, nudging the folks at nProtect might be a good idea also. Unless WSA is quarantining or blocking GG stuff, it's GG itself that is preventing the game from launching, and this counts as an FP.

 

I did that and the game work without any problem.

 

I checked through the logs but there is no mentioning of it being monitor at level 8? Here is an excerpt from the logs:

Code:

[U] c:\asiasoft online pte ltd\aikasea\aikalauncher.exe [MD5: 5F629816F23A7E6FD5973BD032A5845B] [Flags: 112C0800.4116]
[U] c:\asiasoft online pte ltd\aikasea\aikasm.exe [MD5: 9A609A1DD08169AF5D1C1F8C5F57A7CE] [Flags: 012C0801.4123]
[U] c:\asiasoft online pte ltd\aikasea\gameguard\npggnt.des [MD5: FAE978D80D1152AD357639E3097D4D1B] [Flags: 00080000.4128]
[U] c:\asiasoft online pte ltd\aikasea\gameguard\gamemon.des [MD5: 89008AA77E7E04C4E4DDC0C69FFFC520] [Flags: 00081001.4125]
[U] c:\windows\system32\gamemon.des [MD5: 89008AA77E7E04C4E4DDC0C69FFFC520] [Flags: 00081001.4125]
[U] c:\asiasoft online pte ltd\aikasea\gameguard\npggnt64.des [MD5: CAC36A4C23741D7902EA8E5D3A6685F5] [Flags: 00010000.4133]

I read at somewhere that it incorporate bits of spy sweeper but just want to point out a longstanding issues of conflict/incompatibility between webroot(irregardless spy sweeper or WSA) and nProtect GameGuard that was never fix.

 

I'll betchya GG does like being monitored by WSA.

c:\asiasoft online pte ltd\aikasea\gameguard\npggnt.des [MD5: FAE978D80D1152AD357639E3097D4D1B] [Flags: 00080000.4128]
c:\asiasoft online pte ltd\aikasea\gameguard\gamemon.des [MD5: 89008AA77E7E04C4E4DDC0C69FFFC520] [Flags: 00081001.4125]
c:\asiasoft online pte ltd\aikasea\gameguard\npggnt64.des [MD5: CAC36A4C23741D7902EA8E5D3A6685F5] [Flags: 00010000.4133]

Get in touch with Webroot support and see about getting that stuff determined so it isn't unknown, which may help.
File a FP with nProtect people also with the claim that GameGuard won't let the game run with WSA installed on the system.

The only bits of SpySweeper it has is that every file ever detected by SpySweeper is loaded into the cloud. There is zero code from SpySweeper in WSA, which was written from scratch by the Prevx people and would have been Prevx 4.0 previously.

 

Correct - there is no code from SpySweeper or Webroot 7.0, just the detection of threats that they found.

 

Thanks...I will contact the respective persons to get it sort out but shouldn't webroot be working with GG to resolve it?

Thank you for the clarification.

 

No as there are to many programs and updates to those programs to keep up with. Just contact the WSA support inbox and they will Whitelist those files https://www.webrootanywhere.com/servicewelcome.asp? and you can put all your files from the scan log in the support ticket.

TH

 

Sent in a ticket 6 days ago but no reply?

 

That sounds like it someone who was working on it is on vacation over the holidays. Could you PM me the email address you used when you wrote in?

Thanks!