How do I tell which of my games have buffpanel or similar spyware

[Jenkins]

Title

[.357]

I don't know of a comprehensive list.

However, you can block Buffpanel through Windows File Host.

You can block this traffic by modifying your windows hosts file to add the following:

0.0.0.0 buffpanel.com

Google should provide you with better steps.

As for the red-shell spyware, a .bat file should assist.

https://steamcommunity.com/sharedfiles/filedetails/?id=1417938235

[Jenkins]

Thanks Robin3sk. Just check a few more responses if anyone else has thoughts.

[8ullfrog]

eh, is it really steam spyware if the publisher jams it in there? Wouldn't it be Paradox spyware?

[.357]

Originally posted by 8ullfrog:

eh, is it really steam spyware if the publisher jams it in there? Wouldn't it be Paradox spyware?

Pertaining to Redshell, some developers / publishers knowingly went ahead.

https://steamcommunity.com/groups/steamuniverse/discussions/0/1727575977544219957/#c1727575977544220477

2K | Firaxis Games | Aspyr | Squad | Private Division | Behaviour Digital Inc | Digital Extremes | Ankama Studios & Games | Dire Wolf Digital LLC | CI Games | Kyy Games | BISBOG SA | LLC RIKOR IMT | JoyBits & JoyBits Ltd | Free Range Games | upjers GmbH & Co. KG | Entwell Co., Ltd | Gameforge 4D GmbH | Creative Assembly | Soleil | Cygames | NetEase | Outpost Games Inc | Lion Games Co Ltd | Vertigo Games | Wolfdog Interactive | King Art Games | Pixonic | Human Head Studios | NetherRealm Studios | QLOC | Gavra Games | Skydance Interactive | Pigmentum Game Studio | Fat Dog Games | id Software | Saber Interactive | Stunlock Studios | Zombie Studios | Crytek | SEGA | Team17 Digital Limited

Originally posted by beastie:

Thanks Robin3sk. Just check a few more responses if anyone else has thoughts.

Check the thread that i linked above.

You'll find some more details about games and / or devs / pubs that knowingly integrated Redshell.

[Jenkins]

Thanks, everyone. Should help me get started.

[Hikari.ws]

Originally posted by Robin3sk:

I don't know of a comprehensive list.

However, you can block Buffpanel through Windows File Host.

You can block this traffic by modifying your windows hosts file to add the following:

0.0.0.0 buffpanel.com

That doesn't work. The spyware sends stolen data to api.buffpanel.com, not buffpanel.com. Blocking only the main domain won't block api subdomain neither any other subdomain it may use.

This approach suggested by them also doesn't stop the spyware from being installed neither blocks other domains it may start using in future versions.

[Hikari.ws]

Anyone knows which files pertain BuffPanel and Redshell?

If we know their files by name, we could search for these files and delete them.

Sandboxie has feature of forcing processes by .exe file name to be forced to run sandboxed.