Why is Powershell now banned software?

[The Entire Human Race]

You can't say that powershell shouldn't be on your computer, it comes with every version of windows since Windows 7. Powershell is open source too, so you can't say "well you don't know what it can do" because you can easily find out. It's not like it's a hack tool or anything, it's mostly used the same way a linux terminal is.

Why is VAC blacklisting so many pieces of software? Some of these software I can understand to a degree (DLL injectors and tools that come with said injectors), but things that have LITERALLY NO EFFECT ON THE GAME make no sense, such as Hypervisors and start menu 8. Valve, how about instead of making a massive ♥♥♥♥ off blacklist of software you don't want us running for some arbitrary reason, why don't you instead improve detection for known cheats!

[The Entire Human Race]

Originally posted by Toast:

I'm not sure whether powershell itself is actually blacklisted, but some quick searching brought up a few results claiming that some cheats work through powershell. I even found a post basically claiming that VAC refuses to allow a connection to a secure server if powershell is running.

https://steamcommunity.com/discussions/forum/1/2592234299566750624/

Powershell along with some other things are listed in Valve's official documentation here

Originally posted by Valve:

There are a number of common software conflicts that can cause this error. If you are running any of the following software, please disable it while playing:

• CCleaner
  
• Powershell
  
• Sandboxie
  
• Cheat Engine
  
• IObit Start Menu 8
  
• Process Hacker
  
• DLL Injectors
  
• Hypervisors
  
• Steam Idlers

I can understand Cheat Engine, Process Hacker (to an extent), and DLL injectors. However, CCleaner has no impact on a game what-so-ever, Powershell is standard on windows, Sandboxie simply keeps applications in a sandbox (which can allow 1 pc to use multiple steam accounts at once), IObit Start Menu 8 is A ♥♥♥♥♥♥♥ START MENU REPLACEMENT, Hypervisors allow a user to run Virtual Machines, something that WINDOWS ♥♥♥♥♥♥♥ SUPPORTS NATIVELY, and Steam Idlers have nothing to do with an active game session other than gaining cards.

Some of these things seem like arbitrary decisions to cover up the fact their anti-cheat doesn't do ♥♥♥♥♥♥♥♥♥. Cheaters and script authors gloat about how easy VAC is to bypass, and I know first hand that VAC is very inaccurate and one of my accounts even holds 3 vac bans just from Call of Duty alone, and that was for joining a modded lobby, so rather than make their anti-cheat actually do something, they just blacklist certain software and say "yep thats good enough mhm" and then pawn off the actual banning of cheaters to CS:GO's Overwatch.

[Cathulhu]

All those tools are known to actually cause problems. They are listed not because Valve dislikes them, but because they do can cause problems.
Powershell generally doesn't. And with Windows 10 it's even pre-installed. But it can if you use it wrong.

[ALOHA SNACKBAR]

Originally posted by Supreme Mcree First Class:

Originally posted by Toast:

I'm not sure whether powershell itself is actually blacklisted, but some quick searching brought up a few results claiming that some cheats work through powershell. I even found a post basically claiming that VAC refuses to allow a connection to a secure server if powershell is running.

https://steamcommunity.com/discussions/forum/1/2592234299566750624/

Powershell along with some other things are listed in Valve's official documentation here

Originally posted by Valve:

There are a number of common software conflicts that can cause this error. If you are running any of the following software, please disable it while playing:

• CCleaner
  
• Powershell
  
• Sandboxie
  
• Cheat Engine
  
• IObit Start Menu 8
  
• Process Hacker
  
• DLL Injectors
  
• Hypervisors
  
• Steam Idlers

I can understand Cheat Engine, Process Hacker (to an extent), and DLL injectors. However, CCleaner has no impact on a game what-so-ever, Powershell is standard on windows, Sandboxie simply keeps applications in a sandbox (which can allow 1 pc to use multiple steam accounts at once), IObit Start Menu 8 is A ♥♥♥♥♥♥♥ START MENU REPLACEMENT, Hypervisors allow a user to run Virtual Machines, something that WINDOWS ♥♥♥♥♥♥♥ SUPPORTS NATIVELY, and Steam Idlers have nothing to do with an active game session other than gaining cards.

Some of these things seem like arbitrary decisions to cover up the fact their anti-cheat doesn't do ♥♥♥♥♥♥♥♥♥. Cheaters and script authors gloat about how easy VAC is to bypass, and I know first hand that VAC is very inaccurate and one of my accounts even holds 3 vac bans just from Call of Duty alone, and that was for joining a modded lobby, so rather than make their anti-cheat actually do something, they just blacklist certain software and say "yep thats good enough mhm" and then pawn off the actual banning of cheaters to CS:GO's Overwatch.

Joining modded lobbies in Call of Duty won’t cause VAC bans. I’ve joined heaps of modded lobbies on CoD mw2, mw3 and still not VAC banned... stop spreading lies here son.

[Mc'V3nT0n]

Vac is inffective.

[Snaggle]

Originally posted by Supreme Mcree First Class:

Why is VAC blacklisting so many pieces of software?

You're getting confused. They aren't blacklisted and VAC hasn't banned them. They are however known to cause conflicts with VAC. You don't need to remove Powershell you just need to have it not active while on a VAC secured game or you'll risk disconnects and other issues.

[The Entire Human Race]

Originally posted by aRGENTuM tWO:

Joining modded lobbies in Call of Duty won’t cause VAC bans. I’ve joined heaps of modded lobbies on CoD mw2, mw3 and still not VAC banned... stop spreading lies here son.

That's because they disabled VAC in COD titles like 4 or 5 years ago, but not before turning the 1 vac ban you could get in that game into 3 seperate vac bans for spec ops, single player, and multiplayer.

Originally posted by Snaggle:

Originally posted by Supreme Mcree First Class:

Why is VAC blacklisting so many pieces of software?

You're getting confused. They aren't blacklisted and VAC hasn't banned them. They are however known to cause conflicts with VAC. You don't need to remove Powershell you just need to have it not active while on a VAC secured game or you'll risk disconnects and other issues.

To quote the developer of Process Hacker from this page[wj32.org], his software does not interfere with VAC in any way shape or form. Valve has specifically put Process Hacker (and likely other software) on a global blacklist, where if VAC detects this software running, it will deauth the player's session and cause the player to be kicked from a VAC secured lobby or server (even if that lobby or server is an offline server).

The dev of process hacker has contacted Valve and after being stonewalled for a while, was told that unless Process Hacker removes features such as antivirus, firewall, rootkit detection, and process termination, it will continue to blacklist the software. There is an option to run the software without these features (IE do not install the kernel driver), but VAC specifically looks for Process Hacker as software, not the features that they don't like. Very much a knee-jerk reaction by Valve, akin to cutting off a leg because of a sprained ankle.

While I will admit some of these software may cause conflicts with VAC (CCleaner is really dodgy and you shouldn't be running it anyway, sandboxie explicitly isolates the running process and prevents vac from scanning memory outside of Sandboxie's allocated memory, and Cheat engine is a memory scanner and editor which straight up makes sense), a lot of this software won't interfere with VAC in any way and feels like it's a case of Valve just adding random software in to make it seem fair to users of illegitimate software.

You might be wondering why someone would even use Process Hacker, or IObit Start Menu 8. You see, a lot of people simply do not like the look and/or feel of Windows in it's stock form. I for one have already modded windows to draw explorer windows with a dark theme, screw around with taskbars so that I only have my taskbar on one monitor instead of all three, have monitor "regions" where I can quickly and effortlessly maximize a window into a space on my monitor without going full screen, and I also replace the start menu with something more akin to Windows 7 (because I think the Windows 10 start menu is trash). I shouldn't be punished because I made these aesthetic changes to windows...

Furthermore, what about hypervisors? You need hypervisors to do GPU passthrough from one OS to a virtual machine, and a lot of people want to do this what with Windows 10 being so invasive and consumer-hostile (IE host machine running Linux, which has music, voip and other such stuff going, and the guest OS being windows for games that don't support linux). What is Valve telling these users? They are telling them "♥♥♥♥ you, let windows do what it wants to you".

[The Entire Human Race]

Infact, here's that dev's exact response...

Originally posted by dmex:

Valve refuses to discuss why they're blocking Process Hacker and we have not been able to identify code or reproduce evidence of Process Hacker having ever been used to cheat in any Valve games.

The simple fact that you're only kicked from Valve games instead of getting permanently banned shows that Valve also don't even consider Process Hacker a cheating tool.

Process Hacker is also compatible with BattlEye anti-cheat and all features are compatible with BattlEye protected games. Both of those features they want removed can be very easily disabled using the ObRegisterCallbacks API and if Valve was using that function they would be able block a large number of cheaters overnight and every other anti-cheat has been using that function for this exact reason (e.g. BattlEye).

All Valve is doing by blocking Process Hacker is preventing users from being able to identify performance problems and from being able to check processes for malicious activity and what does removing features exactly achieve when those features can be easily disabled?

Here's what every other anti-cheat company has done:
1. Downloaded this code: https://github.com/Microsoft/Windows-dr ... obcallback
2. Compiled it.
3. Signed it.
4. Used it.
5. Stopped blocking Process Hacker.

Microsoft wrote that code for this exact reason and it's very easy to setup and configure... Valve already have a certificate to sign the code so this whole process would take less than an hour to configure and setup but here we are 1 year and 7 months later and Valve has done absolutely nothing to stop anyone cheating and continued to target Process Hacker instead... :?

If you didn't understand it, let me simplify. Process Hacker is legitimate software. It's method of hooking onto programs utilizes an API made by Microsoft to ensure that legitimate software can request to hook onto other software, and legitimate software can decline said hook. It all requires digital signatures verified by Microsoft... something that works on the same principle as HTTPS.

Anti-cheat software such as Battleye utilize this API to block these features that process hacker uses, and as such also block a large number of "cheap" game cheats. Valve isn't using this API, and if the history of VAC is anything to go by, they won't.

VAC is far from infallable. It's an extremely flawed anti-cheat and to be quite honest, I wouldn't at all be surprised if it's only features were checking if there's a writable handle to the process from something not on a whitelist, and seeing if there is software running that is on a blacklist.

[Snaggle]

From what I remember from a topic on Process Hacker only a few months ago, older versions of it still work fine and it was just the newer versions which was causing conflicts.

Again Valve is not blocking this software and it is not banning anyone for using this but it will (the current versions anyway) not work properly with the VAC system. Valve probably could work around, but seeing as they haven't commented on the reasoning behind it there is probably a reason why they won't fix it.

[The Entire Human Race]

Originally posted by Snaggle:

From what I remember from a topic on Process Hacker only a few months ago, older versions of it still work fine and it was just the newer versions which was causing conflicts.

Again Valve is not blocking this software and it is not banning anyone for using this but it will (the current versions anyway) not work properly with the VAC system. Valve probably could work around, but seeing as they haven't commented on the reasoning behind it there is probably a reason why they won't fix it.

If you read the thread I linked, they have actively said they are intentionally deauthing users when they detect the software running. Has nothing to do with interference at all, because again, the dev has verified that his software doesn't interfere with VAC, and that even Battleye has no issue with it.

[Snaggle]

Yea, fair enough. Without some sort of reply from Valve there is no way of knowing the exact reason. Could be laziness, could be something else.