Why powershell.sys?

[Change]

Aside from the RCE vulnerability in Marvel Rivals which the devs completely ignored... Any reason why people are complaining about powershell.sys in the latest update? Is it really required for a game to run powershell commands?

[BigCatRob]

Publicado originalmente por Hiro:

Publicado originalmente por BigCatRob:

It's literally a .sys file that's used to interact with Steam and online servers. What were you looking for here?

Programs can use IPC[en.wikipedia.org] to talk with Steam, they do not require a kernel level driver for that.

True, but this could still be just a file to communicate with their online servers in general. Not Steam. I said AND online servers for a reason. As I've stated before, it's more than likely a false flag of sorts as this has been part of the games files since Day 1. Probably changed some script around or something that trips anti-virus software because the .sys file runs in tandem with the anti-cheat so parameters may have been adjusted with the most recent update which is what's causing it etc. etc.

[KeV]

Your explanation there makes alot of sense. Let's hope for a quick fix then later today, bc right now it's terrible to play this way

[Hiro]

I'm just saying that a kernel level driver is not required to communicate with Steam neither to contact online servers. In fact that would be the worst tool for the job.

However I do not believe it is anything malicious.
I agree with it being something related to anti-cheat.

[KeV]

Publicado originalmente por Hiro:

I'm just saying that a kernel level driver is not required to communicate with Steam neither to contact online servers. In fact that would be the worst tool for the job.

However I do not believe it is anything malicious.
I agree with it being something related to anti-cheat.

I believe it could be the launcher. I get the Avast message once the launcher starts. If i ignore the avast message, the anti-cheat still starts up with no issue, same as the game

[Change]

So far I am reading reports coming from AVG, Norton, Avast and Malwarebytes (the most important one) on these topics. All alerting about powershell.sys kernel driver.

Not looking good.

[LafonZo]

Yup i got it too, and now the game stutters like crazy. Hope they fixe it soon

[Brother Lao]

Same problem.. making game stutter to all hell.

[IndianaJones]

Publicado originalmente por Change:

Aside from the RCE vulnerability in Marvel Rivals which the devs completely ignored... Any reason why people are complaining about powershell.sys in the latest update? Is it really required for a game to run powershell commands?

It might be a part of in-house anti-cheat.
Because it is too expensive to buy license for decent one. 🤓

[Krumpazoid]

Publicado originalmente por BigCatRob:

People thinking Powershell is spyware is so funny
Literally just type into your taskbar search for Powershell if on windows and you'll see both the ISE and x86 applications
It's used by multiple programs on your computer to automate processes

No, it's not some chinese spyware

No, you can't disable PowerShell unless you want to royally bork over your WIndows OS

No, it not a recent addition. It's been there since launch and is only being flagged now by your antivirus so more than likely a false positive.

It's just part of western g4m3rZ being manipulated into thinking scary chinese commies are going to steal their previous.... hmmm information about what porn they watch? Literally conspiracy theorism becoming mainstream.

[RhodosGuard]

Publicado originalmente por BigCatRob:

Publicado originalmente por ◬ illumiTriX ◬:

powershell can be used by hackers to get around antivirus just wanna let you know...

Ah yes, the hacker wants you, yes specifically YOU the random individual, and your everyday boring gamer information. If somebody really wanted to get at you, they would've done it by now with the extensive amount of applications that communicate with each other.

You do know that not every hacker wants information?
This is the kind of attitude that lets second rate scammers just scatter ransomware whereever they want.

You're the kind of person who, despite usually being empethatic with people being exploited, I hope actually gets hit with something for once.

[BigCatRob]

Publicado originalmente por RhodosGuard:

Publicado originalmente por BigCatRob:

Ah yes, the hacker wants you, yes specifically YOU the random individual, and your everyday boring gamer information. If somebody really wanted to get at you, they would've done it by now with the extensive amount of applications that communicate with each other.

You do know that not every hacker wants information?
This is the kind of attitude that lets second rate scammers just scatter ransomware whereever they want.

You're the kind of person who, despite usually being empethatic with people being exploited, I hope actually gets hit with something for once.

It's the truth though because no hacker is gonna be targeting specifically you unless they are going out of their way to do so and/or have reason to whether it's information or attempting to hold your PC hostage via ransomware. The latter though you usually have to be clicking on random ♥♥♥♥ and/or just not be that savvy with tech/internet stuff to begin with and just have something be randomly downloaded. Been through that once during my teenage years when my mom clicked on one of those "your computer may have a virus" adverts on the household desktop. Really fun.

[Schmeichel Jackson]

Publicado originalmente por Hiro:

I'm just saying that a kernel level driver is not required to communicate with Steam neither to contact online servers. In fact that would be the worst tool for the job.

However I do not believe it is anything malicious.
I agree with it being something related to anti-cheat.

I Just turned off block kernal drivers in AVG, im confident in a false positive too, i think something has been altered in the file that AVG doesnt recognise previously or something along those lines, any third party antivirus essentially has a duty to flag any little thing to ensure that no claims get put to AVG for them not doing their job or something idk, but i just loaded up my game and no stutters, does that not imply that the game requires the "kernal driver" powershell.sys to function optimally? proving wrong your statement?

[Bunny]

Publicado originalmente por Schmeichel Jackson:

Publicado originalmente por Hiro:

I'm just saying that a kernel level driver is not required to communicate with Steam neither to contact online servers. In fact that would be the worst tool for the job.

However I do not believe it is anything malicious.
I agree with it being something related to anti-cheat.

I Just turned off block kernal drivers in AVG, im confident in a false positive too, i think something has been altered in the file that AVG doesnt recognise previously or something along those lines, any third party antivirus essentially has a duty to flag any little thing to ensure that no claims get put to AVG for them not doing their job or something idk, but i just loaded up my game and no stutters, does that not imply that the game requires the "kernal driver" powershell.sys to function optimally? proving wrong your statement?

did you have stutters before you did that ?

[Decompression]

My god… People need to stop using Avast. Bloatware to the core that does absolutely nothing. Windows Defender is legitimately all you need. Same goes for Norton. Stop paying for useless services.

Also this isn’t Chinese spyware or even Netease trying to do anything. It’s just a flag and an incorrect one at that.

[Bunny]

Publicado originalmente por Decompression:

My god… People need to stop using Avast. Bloatware to the core that does absolutely nothing. Windows Defender is legitimately all you need. Same goes for Norton. Stop paying for useless services.

Also this isn’t Chinese spyware or even Netease trying to do anything. It’s just a flag and an incorrect one at that.

When I buy my new pc avast is the first thing im NOT gonna install again. I have it and so far only caused problems and annoyed me. Do you know how to make an exception in it tho so that thing doesnt get blocked everytime I open my game ?