Suspicious Activity on SC Update to GC 1.31

Possible virus/trojan install coincidental with my 1.31 update.

from GalCiv2 Forums
Hey, gang,

I just updated GC II to 1.31 last night via SC.

When the update finished, it told me I needed to reboot my PC.

I thought that odd for a game install, but did it anyway.

I was able to putz around with the new GC for a couple hours after (thanks for fixing the ship selection process).

When I was finished, I hit shut down and walked away to go to bed.

In the AM, it had not shut down. It hung on the shutting down screen.

I hit the reset button, and when the PC rebooted, my Norton AV had become unusable. I found an unnamed application running in the background through msconfig. I disabled it and restarted.

I left an on-line virus scanner running while I had to run off to work today, so I don't know what the status is as I type this.

Could you please ensure that the 1.31.x update didn't have a "friend" attach itself to the executable? Thanks in advance.
14,198 views 22 replies
Reply #2 from GalCiv2 Forums Top
There's no virus.
Sins of a Solar Empire II
Reply #3 from GalCiv2 Forums Top
Norton antivirus is a piece of shite that couldn't detect a virus if it smacked it in the face. GC2 is not a virus, Norton thinks it is because of the way it runs.

I'd advise uninstalling that garbage anyway. It doesn't actually work, for a start.
Reply #4 from GalCiv2 Forums Top
Should I have expected to get a message to reboot my system after using SC to update GC to 1.31?

And thanks for the useless advice, Marc. I'm really not in the mood. GamersGates downloader trashed my system a couple weeks ago and you'll excuse me if I'm a little sensitive to things like this happening immediately after using a downloader from anyone, even SD.
Reply #5 from GalCiv2 Forums Top
Oh it's definately spyware. [/sarcasm]
Reply #6 from GalCiv2 Forums Top
Should I have expected to get a message to reboot my system after using SC to update GC to 1.31?


I don't think I've ever had that from SDC, at most it reboots itself after an SD update, but not the computer.

I had no problems with updating at all, maybe something somewhere just decided to twitch on you?
Reply #7 from GalCiv2 Forums Top
Hoping that's all it is, Ug. Whatever it was, it triggered immediately after I updated GC2. Also glad to hear that there is nothing wrong with the file on SC.

The worthless opinions of trolls notwithstanding, something happened and it was in concert with the update.
Reply #8 from GalCiv2 Forums Top
You sure you're using a legit copy of SDC? Could there be a trojan dropper in the wild? I hanve't heard of any, but you never know. That would explain the reboot since there's no reason to have to reboot when updating GalCiv...
Reply #9 from GalCiv2 Forums Top
Its always possible you picked up some sort of trojan\virus that was wating for any files to be installed to prompt for a restart....But as to one of you OP ideas, there shouldn't be anything wrong with the files on Stardock's end. If there were there would be a lot more people with this problem.

If Norton doesn't catch anything for you, try a couple spyware scanners (I use SpyBot and AdAware) and then see if you cant't find a free virus scanner to use once (I use Sophos if my AV scanner stops working. Warning though, it isnt't the most user friendly but its free and works well).

Other than that, check what that file running in the background was online and see if it was a virus of sometime and if there is an uninstaller or cleaner program.

Best of luck to ya!
Reply #10 from GalCiv2 Forums Top
I redownloaded SDC last week after I wound up reinstalling the OS when the GG/SotS installer caused my system to slow down to a pace where things were moving in terms of microbits. So that came directly from SD.

Could have been something that just coincidentally triggered at the same time. Could also just be some kind of failure in NAV. But hopefully everyone understands my cause for alarm. The fast reply from SD about the integrity of the build was reassuring. Had there been an actual problem on their end, they would certainly have wanted to know so that it could be remedied.

I'll have to wait until evening to follow up, assuming I can find out what is wrong. If all else fails, I have a recent Ghost image that can be restored that may reset the system to the same state it was in before I updated GC2. Hopefully it won't come to that, but then I would know if the issue is replicatable.

Thanks everyone for your cooperation and helpful hints.
Reply #11 from Stardock Forums Top
tis possible it was an earlier remnant from something waiting for an install/reboot in order to hide itself
Reply #12 from Stardock Forums Top
SDC should only call for a reboot if you update certain ODNT products, such as Windowblinds. If you don't have those, it shouldn't do that (certainly not for GC2).
Reply #13 from GalCiv2 Forums Top
There is nothing "fishy" with 1.31 and trust me I would have detected it if there was.

Norton Antivirus is the bigest hoax ever. There are lots of free virus scanners which does the faster and better. NA is never up to date on the new or nasty keyloggers or trojans either. (Or most of the old ones for that mather)

The different in running a system without NA aslong as you had the windows firewall enabled seems to be little.

After working with this for the last two years and getting the honor too see how useless NA is in reality Im quite shocked. Most people seem to think they are invincible with NA alone. A Computer I fixed recently had over 4000 trojans on it, guess how many of those NA detected? 0.

sorry for the rant, but NA pisses me off to no end and DG is great
Reply #14 from GalCiv2 Forums Top
Stardock asked me to reboot after I updated GalCiv2 to the version 1.31. The only other product I have through Stardock is the free graphic toolbar thing that scrolls icons like Mac OS. That wasn't updated as far as I could tell.

I haven't had any system problems in relation to this, just an FYI about it since you say it isn't supposed to do that.
Reply #15 from GalCiv2 Forums Top
Could Norton think it was a virus because it connects to the internet? I know x-fire acts a little weird when I go on the metaverse.
Reply #16 from GalCiv2 Forums Top
Whatever the kinks were, I believe I ironed them out.

I could not track down what the "unnamed startup application" that triggered on reboot was (presuming its in remission or was flushed after I deactivated it). Thorough scanning of the system did not uncovered any infected files or other traces of malware.

The effect on Norton was that the "integrator" was damaged and I could not open NAV directly. The next LiveUpdate I did seems to have fixed it (may have been a stealth patch on Symantec's part).

I'm not using any of the non-game SD tools, so the call for reboot remains mysterious. I'm "glad" to see that someone else saw it so I know I'm not insane.
Reply #17 from GalCiv2 Forums Top
Everytime I've updated GC2, SDC has said it wanted to reboot and I've done so everytime. I too had wondered why the hell I'd need to reboot for a game.

No problems to report.
Reply #18 from GalCiv2 Forums Top
Everytime I've updated GC2, SDC has said it wanted to reboot and I've done so everytime. I too had wondered why the hell I'd need to reboot for a game.


Told you guys before. Stardock works for the CIA! They're downloading back door access to our hard drives! Seriously, never had SD ask me to reboot. Could it have something to do with an individual OS?
Reply #19 from GalCiv2 Forums Top
Hehe, Norton Antivirus is an example of the cure being worse than the disease. Try ClamWin WWW Link. I don't use Stardock Central, I just download the updates from the downloads section here. Never been asked to reboot.

Reply #20 from GalCiv2 Forums Top
NAV is one of the most mediocre AV's out there. Has been since Symantec took it over. All marketing fuff. It is a resource hog, and it is not the most effective at catching critters.

Try NOD32. I recommend it to my clients. It uses 1/3rd of the system resources NAV does, and very very few wild critters get past it. (and since it uses less sytem resources, there are more for other apps....such as running GalCiv2 with the advanced algrythms.... )

Don't take my word - do a google and read the independent reivews of different AV's - NAV is hardly the best, never the cheapest. There are several that are better, cheaper, and less intrusive.

Reply #21 from GalCiv2 Forums Top
When I down loaded 1.31 it asked me for a system reboot as well. Not being very computer savvy, I do what the damn thing tells me to do.

With that said, I have not played GalCiv2, or any other game for that matter in the last week and a half. About a day after the reboot, files on my system started to disappear. First, music files, then the .jpg files. Random folders from various programs deleted making them worthless. Computer slowed to a crawl, then the system started to continuously shut it self down and reboot. This happened over the course of a couple days.

Currently the computer is at the repair shop, one of my best friends owns the place. Anyhow, he thought it was a hardware issue at first with all the problems he was having keeping the system running. I asked him to back up some of my remaining .jpg files as well as some work documents. He did so. Within 3 hours, the computer he down loaded them to experienced the same problems as mine.

Virus. Where it came from? Dunno. My mail isn't even set up on that machine. By the way, it is only 3 months old. Where ever it came from, it is one nasty virus.

I didn't even think it could have even been a possibility it came from SD until I saw this post. Kryo...... Are you sure?
Reply #22 from GalCiv2 Forums Top
Virus. Where it came from? Dunno. My mail isn't even set up on that machine. By the way, it is only 3 months old. Where ever it came from, it is one nasty virus.


Hence my reasons for not wanting a game to be available as a download only. Please oh please, offer a cd version of Dark Avatar to me just as quickly as the download is available. I don't want to explain an event like this to my wife!