Possible Malware Embedded in Latest Build?

[ymrich]

It took me some time to connect this to PN, but I have now reliably determined that whenever I launch PN and alt-tab to another tab, while a save is loading (as my saves are excessively large and take a very long time to load), PlanetNomads.exe is trying to establish a connection to: survey-smiles.com, which is then blocked by my NOD32 (this however does not happen, when I do not alt-tab out of PN). survey-smiles.com has been marked as a malicious coin-mining operation. Has anyone noticed this issue? Any way to clean the exe? I wonder if this has something to do with the terrible performance of PN.

[headmonkeyboy]

I doubt other versions are affected but it still wouldn't be a bad idea to "contain" or delete the file in every game. It serves no purpose you actually need. Better safe than sorry.

While I'm here, still no reply from the support email I sent.

[-₪EPIC₪- Fail]

Interesting... its not in the game code itself as far as I know. I perused the decompiled code a bit(not thoroughly) and didn't notice anything like that. It could be in any of the dll files the game loads though.

[headmonkeyboy]

Like I said, it's in the Steamworks.net txt file. If that file is opened by the game, the issue happens. Move or delete, problem solved.

[Thiesen]

uhm... thqat Steamworks page tries to run a Flash app... but since Flash is dead it doesn't load it...

[ymrich]

So, my Steamworks.net file is still in the "filter" folder, still deleted and not returned in the "Plugins" folder, but the SurveySmiles messages just started appearing again. This was in connection to me switching the game into windowed mode...

[-₪EPIC₪- Fail]

I added the SurveySmiles IP to my firewall to block.

[ymrich]

Yes, I have my NOD32 catch it, but it's still annoying to know that the thing is still trying, and apparently steamworks.net isn't necessarily the vehicle. So where does it come from?