VAC Ban because DLL altering Virus?

[IDB9]

Hi everyone,

I have been playing CS GO pretty much since it came out, and I have come to love the game. However, I found my account to be VAC banned today. I have never cheated before so I was very surprised. However, for the past two weeks whenever I have played CS GO, my i7 jumps to 95% cpu usage, so obviously there is something running. I looked into it today and it turns out that I have a virus disguising itself as COM Surrogate. Information can be found here: http://malwaretips.com/blogs/dllhost-exe-32-com-surrogate-removal/

Now I may have been VAC banned because this piece of malware was messing with my game files, or changing something.

Furthermore, I recently installed a RAID configuration however my motherboard does not support a 2 tb raid configuration. I have repeatedly had problems where my files fail to copy or do not copy completely. Could this be the cause of the VAC ban? Perhaps game files were corrupted or changed through bad copying.

I know that many of you will call me a cheater, and I respect that -- VAC does its job most of the time and it has earned its respect. However, I ask you to consider the likelihood of the two scenarios above. If it is possible that the VAC ban could have been triggered by something else, what would you recommend be my course of action?

Thank you to everyone who comments, especially if it is constructive.

Best,

IDB9

[TheSinglePlayer]

Contact Steam Support, scan your system with an anti-virus software, once the infected files such as dll are detected, put it in quarantine and send the infected file to Steam Support for them to examine if that virus you are talking about is really the one that triggered the vac ban. Other than that, good luck.

[IDB9]

Thank you for your reply. I am in the process of doing just that. I hope too :)

[Satoru]

That malware didnt'c ause your ban

Your cheating did

VAC doesn't interfere with file copies

[Panda ツ #WTB]

Originally posted by Satoru:

That malware didnt'c ause your ban

Your cheating did

Lol, add to what he said he already respects. Likely people would call you a cheater if you got VAC banned and you said "you didn't cheat". Read through the description before being a ♥♥♥♥ to someone you don't know.

[IDB9]

Originally posted by Satoru:

That malware didnt'c ause your ban

Your cheating did

VAC doesn't interfere with file copies

This is a valid concern. However, VAC will ban anyone who has altered game files as well, something many cheats do. My point is that it was not a cheat that did this to me, but rather malware or a corrupted RAID transfer during, say, an update.

Thank you for concern Satoru, Happy Thanksgiving!

[Satoru]

Originally posted by IDB9:

This is a valid concern. However, VAC will ban anyone who has altered game files as well, something many cheats do. My point is that it was not a cheat that did this to me, but rather malware

While a nice theory, it has a gaping Mac Truck sized hole in it. The COM Surrogatte malware is never executed by the OS nor by any games.

The malware simply is called dllhost.exe but is not in the main windows directories. The malware is simply called that.

No program will ever call the corrupted dllhost.exe because the OS always runs the one from the system/system32 directory. VAC will never detect the changed dllhost.exe because it's never called by the OS during the game.

r a corrupted RAID transfer during, say, an update.

Again nice theory but this then requires the RAID array to corrupt your files in such a way as to exactly match the signature and to execute in memory the same way a cheat would. There are not enough monkeys and typewriters in the world to make that happen.

[IDB9]

Ok Satoru thank you for your reply. While it is making me pessimistic, perhaps you are correct that it is a cheat that is causing this to happen. That being said, how do I find the program that got me VAC banned so I can take it out? I was able to deal with the Malware and fixed the RAID configuration. But if neither of those will solve the problem, then I am afraid to get a new account and get CS GO again if that will just lead to another VAC ban. Any ideas?

[The Longest Rose]

Originally posted by IDB9:

Ok Satoru thank you for your reply. While it is making me pessimistic, perhaps you are correct that it is a cheat that is causing this to happen. That being said, how do I find the program that got me VAC banned so I can take it out? I was able to deal with the Malware and fixed the RAID configuration. But if neither of those will solve the problem, then I am afraid to get a new account and get CS GO again if that will just lead to another VAC ban. Any ideas?

Very unfortunately for you, the only way to be absolutely sure of it is to reformat the hard drive and reinstall the operating system. Anything less comes at your own risk.

[DNs]

VAC scans only for blacklisted cheats not for some random coded trojans or other stuff, its not a antivirus!
Its justthe same like xxxxx times before, you downloaded a virus infected cheat and you get banned, for the cheat not the virus.

Just calculating the odds. I wish there would be a hint why the player got banhammered, so much badstories would have been popped like bubbles, but sadly its not implemented yet.

[Zukabazuka]

It can scan for changed dll files. Remember MW2 bans with over 1000 people getting banned? That was the cause of a dll file not being validated by steam. Any changes to a dll file will cause bans. How else would it have banned people. But it would be important dll files already used by the game. If you add some dll file through some other program it might be different.

You can program a virus to target steam files but the question would be why, you have to get those people to that site and somehow spread it through them. Then having them play a VAC game. I also heard Valve removing the bans from those who where banned by such rare virus.

[BossGalaga]

So you have a virus whose sole function and purpose is to inject itself into CS:GO and get you VAC banned? Man, that's some scary virus right there.

[IDB9]

Bro I dont know what I have lol. If thats the case then its crazy. But it seems like I may actually have something in my computer that is triggering this -- but I have no idea how it got there because I download basically nothing on my PC (i use my laptop for all the other stuff). So im a bit confused :/

[IDB9]

But apparenly that dll malware was communicating to some Russian website. Thats all i know,

[Satoru]

Realistically your account was likely compromised and cheated on