Tavern.exe is suspicious

[RockDad]

I've seen a few post talking about Tavern.exe or TavernWorker.exe being malware. After reading through the forums most of the people commenting either,
A. Don't know what it is or just echoing what's been said/assumed or
B. Don't care if it is malware.

This nerd trapped me because I genuinely wanted to see if it was just a anti-cheat or something nefarious.

Using sandbox tools such as Hybrid Analysis and Virus total I uploaded the suspected .exe's into virtual sandboxs. This is what I found...

TavernWorker.exe was clean.... Tavern.exe on the other hand could be malware...

Tavern.exe performs the following suspicious indicators...

• Anti-Detection/Stealthyness through API calls
  
• Anti-Reverse Engineering through Static Parser
  
• Cryptographic Related (It's encrypting and compressing a binary file)
  
• Environment Awareness (Executes WMI queries known for VM detection)
  
• Found a potential email address in binary/memory (Although I am skeptical of this as the email seems to point to ZY Partners; a Chinese Law firm)
  
• Spyware/information Retrival (Calls an API typically used to enumerate processes encountered for a System snapshot. As well as Executes WMI queries to gather system info)
  
• Unusual characteristic

There are other things it does that is more informal then suspicious like accessing device drivers, etc. It would explain why one user reported his hard drive spinning up despite D&D being installed on his SSD.

Please note that just because it is suspicious does not mean its malware. There are false positives. However the dev's need to address this because whatever its doing its encrypting and hiding its work. We can get a rough idea through indicators but the exact nature of the .exe is a mystery.

I will still be looking into this. If anyone would like to join and shed some light on this; Welcome!

Please keep unhelpful comments to yourself.

I'm not playing or having anything more to do with this game or Tavern.exe.

Edit: I'm not playing or having anything more to do with this game or Tavern.exe. Please stop DM'ing me about it

[Dealman]

So, you just uploaded the exe to these online scanners and repeat what they reported...

WMI is used for a whole plethora of things, for example you can measure various performance metrics of a system such as the CPU usage. It's what the Task Manager uses for CPU utilization.

As for the email, it may just be that Tavern/TavernWorker is a kind of crash reporter and it sends crash data to that address.

Nothing about this is particularly suspicious, it just seems to be your typical in-house process used for gathering telemetry data and potentially anti-cheat purposes.

[Major Lee Ree]

I've got nothing to hide, it can do whatever it wants for me if it's gonna catch more cheaters.

[Kankaku]

It's quite literally the games anticheat...

[MisterSmellies]

Get Muta to look in to it

[Boutus]

Malware.... Yea mate, the dev team are secretly putting malware on your computer.

[RockDad]

Opprinnelig skrevet av Dealman:

Nothing about this is particularly suspicious, it just seems to be your typical in-house process used for gathering telemetry data and potentially anti-cheat purposes.

The data says otherwise. Hence this post...

Virus software like Webroot classify the .exe as malware. The whole point of this post is to clarify if its a false positive or not with data...

Just saying, "it may be... etc, I don't care if, etc" is not at all helpful.

[RockDad]

Opprinnelig skrevet av Boutus:

Malware.... Yea mate, the dev team are secretly putting malware on your computer.

Mate, i believe the word used was "suspicious".

But you also didn't read or comprehend the last sentience either so I guess I shouldn't be surprised by your comment.

[chevalierknight]

Opprinnelig skrevet av RockDad:

I've seen a few post talking about Tavern.exe or TavernWorker.exe being malware. After reading through the forums most of the people commenting either,
A. Don't know what it is or just echoing what's been said/assumed or
B. Don't care if it is malware.

This nerd trapped me because I genuinely wanted to see if it was just a anti-cheat or something nefarious.

Using sandbox tools such as Hybrid Analysis and Virus total I uploaded the suspected .exe's into virtual sandboxs. This is what I found...

TavernWorker.exe was clean.... Tavern.exe on the other hand could be malware...

Tavern.exe performs the following suspicious indicators...

• Anti-Detection/Stealthyness through API calls
  
• Anti-Reverse Engineering through Static Parser
  
• Cryptographic Related (It's encrypting and compressing a binary file)
  
• Environment Awareness (Executes WMI queries known for VM detection)
  
• Found a potential email address in binary/memory (Although I am skeptical of this as the email seems to point to ZY Partners; a Chinese Law firm)
  
• Spyware/information Retrival (Calls an API typically used to enumerate processes encountered for a System snapshot. As well as Executes WMI queries to gather system info)
  
• Unusual characteristic

There are other things it does that is more informal then suspicious like accessing device drivers, etc. It would explain why one user reported his hard drive spinning up despite D&D being installed on his SSD.

Please note that just because it is suspicious does not mean its malware. There are false positives. However the dev's need to address this because whatever its doing its encrypting and hiding its work. We can get a rough idea through indicators but the exact nature of the .exe is a mystery.

I will still be looking into this. If anyone would like to join and shed some light on this; Welcome!

Please keep unhelpful comments to yourself.

can i ask if i uninstall the game then uninstall tavern worker in the installed apps does this all so remove Tavern.exe too are both things removed? have you tested if uninstalling tavern removes both i only ask because i can see tarven worker is removed from services but tavern.exe never shows there when games installed and doesnt show in the task manger only worker and you put "Anti-Detection/Stealthyness through API calls" does this mean its hidden on the system i just want to know iv uninstalled it along side worker when i uninstalled it in the apps section

[RockDad]

Opprinnelig skrevet av chevalierknight:

Opprinnelig skrevet av RockDad:

I've seen a few post talking about Tavern.exe or TavernWorker.exe being malware. After reading through the forums most of the people commenting either,
A. Don't know what it is or just echoing what's been said/assumed or
B. Don't care if it is malware.

This nerd trapped me because I genuinely wanted to see if it was just a anti-cheat or something nefarious.

Using sandbox tools such as Hybrid Analysis and Virus total I uploaded the suspected .exe's into virtual sandboxs. This is what I found...

TavernWorker.exe was clean.... Tavern.exe on the other hand could be malware...

Tavern.exe performs the following suspicious indicators...

• Anti-Detection/Stealthyness through API calls
  
• Anti-Reverse Engineering through Static Parser
  
• Cryptographic Related (It's encrypting and compressing a binary file)
  
• Environment Awareness (Executes WMI queries known for VM detection)
  
• Found a potential email address in binary/memory (Although I am skeptical of this as the email seems to point to ZY Partners; a Chinese Law firm)
  
• Spyware/information Retrival (Calls an API typically used to enumerate processes encountered for a System snapshot. As well as Executes WMI queries to gather system info)
  
• Unusual characteristic

There are other things it does that is more informal then suspicious like accessing device drivers, etc. It would explain why one user reported his hard drive spinning up despite D&D being installed on his SSD.

Please note that just because it is suspicious does not mean its malware. There are false positives. However the dev's need to address this because whatever its doing its encrypting and hiding its work. We can get a rough idea through indicators but the exact nature of the .exe is a mystery.

I will still be looking into this. If anyone would like to join and shed some light on this; Welcome!

Please keep unhelpful comments to yourself.

can i ask if i uninstall the game then uninstall tavern worker in the installed apps does this all so remove Tavern.exe too are both things removed? have you tested if uninstalling tavern removes both i only ask because i can see tarven worker is removed from services but tavern.exe never shows there when games installed and doesnt show in the task manger only worker and you put "Anti-Detection/Stealthyness through API calls" does this mean its hidden on the system i just want to know iv uninstalled it along side worker when i uninstalled it in the apps section

Try the uninstall program in the game files. If that doesn't work and the tavern program is still present then that's even very odd

[Aldalómë]

Why is there 2 different programs running as anti-cheat? the "anti-cheat" scanning all your files is dubious as hell when will the devs talk about this crap?

Also, fanboys should stop dickriding companies especially when the anti-cheat system is dubious or poorly implemented.

[Guntrigger]

Weird that after uninstalling the game TavernWorker still remains and has to be uninstalled using add/remove programs seperately. Tavern.exe doesn't seem to remain after this. It leaves some files in AppData, but it appears that they may just be logs.

[chevalierknight]

Opprinnelig skrevet av Guntrigger:

Weird that after uninstalling the game TavernWorker still remains and has to be uninstalled using add/remove programs seperately. Tavern.exe doesn't seem to remain after this. It leaves some files in AppData, but it appears that they may just be logs.

oh that good i was worried that it had stayed i deleted those logs and did a file search and nothing else pops up with tavern. i have an anxiety disorder and this was really effecting so i uninstalled the game and the worker app but the taverm.exe was really making me ill

[Louis Harriger]

Opprinnelig skrevet av chevalierknight:

Opprinnelig skrevet av Guntrigger:

Weird that after uninstalling the game TavernWorker still remains and has to be uninstalled using add/remove programs seperately. Tavern.exe doesn't seem to remain after this. It leaves some files in AppData, but it appears that they may just be logs.

oh that good i was worried that it had stayed i deleted those logs and did a file search and nothing else pops up with tavern. i have an anxiety disorder and this was really effecting so i uninstalled the game and the worker app but the taverm.exe was really making me ill

Open up services and you can disable it there if you want to take another precaution.

[chevalierknight]

Opprinnelig skrevet av Louis Harriger:

Opprinnelig skrevet av chevalierknight:

oh that good i was worried that it had stayed i deleted those logs and did a file search and nothing else pops up with tavern. i have an anxiety disorder and this was really effecting so i uninstalled the game and the worker app but the taverm.exe was really making me ill

Open up services and you can disable it there if you want to take another precaution.

when i uninstalled it from apps it removed it from services i was just worried it didn't remove all of it

[Crunchy[Daz]]

HDDs can spin up for MANY reasons. Someone saying "hey my HDD spun up when I was playing Dark and Darker" is by no means even worth mentioning, it has zero substance.