Last resort logo

SWAT 3 - LAST RESORT GAME MODIFICATION


Spam Prevention - PLEASE READ !! (23 Apr 2021)

Due to a problem with spammers the rules for posting in the forums have changed for new users.

Newly registered users won't have their posts published until a moderator approves them.

Single Report of Strange Behavior of Last Resort

More
7 years 1 month ago - 7 years 1 month ago #292 by Slippery Jim
For the sake of full disclosure I want to write about a very strange report I got this week about the Last Resort mod. I am always very concerned about the security and safety of my computer and yours. I have modded for the Swat 3 community for about 17 years now and my clean reputation is very important. Without trust people won't use my mods and all the work I have put into it would be wasted.

A user wrote me on Mod Database to ask about a strange behaviour he noticed. He claims that when he uses the Last Resort mod his Windows update setting was changed from automatic download to off.

I have three Windows 10 machines and one Windows 7 machine in my house and the Last Resort mod is on all of them. I have never seen this behaviour.

  • The Last Resort Launcher doesn't write or make changes to the Windows registry. As far as I know to change the Windows update setting you have to write to the Windows Registry. The only time changes are made to the registry is when you first install the mod. The installer allows you to make shortcuts to the Last Resort mod in the Windows Start menu.

  • All my computers have up-to-date antivirus (Avast) and I also frequently do scans with up-to-date Malwarebytes. I also occasionally use CCleaner to inspect all the startup applications to ensure that there are no surprises.

  • The computer that I code and compile the Last Resort mod on is also the machine I do my banking and shopping on because I know it is the cleanest in terms of how frequently I scan it.

This person reports that he also scans his system with Avast and Malwarebytes and says it reports as clean also.

I always highly recommend to everyone if they have suspicions about any file to upload to TotalVirus.

Here is the results for the Last_Resort.exe file:

www.virustotal.com/en/file/a0034b1b732d0...analysis/1488240527/

There is one false positive. This isn't unusual to get especially with an old Visual Basic 6 app like this.

Either this person is trolling me or they are mistaken about this behaviour. It is possible his machine is infected but it doesn't have anything to do with The Last Resort mod or it's launcher. Nothing is in the code that is malicious or that could do this sort of thing. I don't even know how this sort of thing would even be achieved other than assuming you would have to modify the Windows Registry. Can you even turn off automatic updates on Windows 10 machines?

If he was simply trolling me you would have thought he would post on various forums. He has just privately sent me messages on The Mod Database website. I have to assume this person legitimately thinks this is happening on his system.

Please Log in or Create an account to join the conversation.

More
7 years 1 month ago - 7 years 1 month ago #293 by Slippery Jim
Here is our conversation. This person's first contact with me was already a little paranoid about visiting this website. I have deleted his name for privacy.

[name redacted] Feb 21 2017 says:

Why is that Google safebrowsing reports uncommon download warnings about your site? False positive?

Google safebrowsing


Slippery.Jim Feb 21 2017 says:

I think it is just detecting that there are files available for downloading. Either the Last Resort mod or some of the custom mod tools hosted on the site. Here is the explanation it is giving:

"Some downloads on this site are new or not commonly downloaded by users, and may be dangerous. Safe Browsing is warning users on these downloads."

I have been a mod maker in the Swat 3 community since the game first came out (1999) and would never do anything to risk a bad reputation.

The website itself is using Joomla that is updated always to the latest version.


Update: I just noticed that the safebrowsing website reports that it this website is "not dangerous" now. When this person emailed me it did gave a warning about new and/or potentially dangerous downloads. It was just a general warning about the fact that we have .exe files available for downloading. Perhaps it was a warning because I had just released a new version of the mod. Don't know why it still doesn't give that warning since all the apps are still here for download. I assume because the latest version of the mod isn't new any more.


Four days later after his initial worry about visiting this website he emails back with a new concern:

[name redacted] Feb 25 2017 says:

Kinda weird how every time after launching Last Resort though, it alters Windows Update settings. Automatic updating is reported as turned off and I have to turn if on again.

Slippery.Jim Feb 25 2017 says:

Huh? That in no way is connected with the Last Resort mod, lol. There is nothing in the Last Resort code that makes windows registration changes at all.

I have Windows 10 and it certainly doesn't do anything like that for me.

I should also say that my other machine is a Windows 7 machine and it doesn't behave that way either.

Very strange. Do you have up to date anti-virus and have you done a full system scan lately?

[name redacted] Feb 26 2017 says:

Yeah, up to date Avast, and haven't found anything yet. Sometimes when I launch Last Resort I'll get a warning from Avast saying that it might be sketchy, but it usually comes back after a few seconds and says that everything's cool.

Slippery.Jim Feb 26 2017 says:

Ya I use Avast also. The Behaviour Shield scan always runs on an .exe file the first time it is run. If it has found anything sketchy it would immediately delete the file and protect your system. Even when it isolates a file it doesn't mean it is malware. Behaviour Shield uploads the suspect file to Avast and their people test it. Apparently if they have a false positive they will unban it from Behaviour Shield within hours. I don't know how accurate that claim it but that is what I read on their website, lol.

You may also want to double check your system with Malwarebytes. You can have it on your system so it only runs when you want (ie turn off real time protection). If you use it to only scan when you want to it doesn't slow down your system and doesn't conflict with Avast. I always like to double check my system since sometimes one anti-virus misses things. Malwarebytes.com

I seriously have no clue why you would have this sort of behavior. The Last Resort launcher doesn't write to the Windows Registry (which I imagine is what would need to be done to turn off the automatic updating).

One thing you should try to confirm exactly when it happens. Confirm your Windows updates is set to on, start the Last Resort Launcher, check to see if if updates are still on, quit the launcher. There are three buttons that the Launcher does things before shutting down 1) Quit and Cancel 2) Save and Launch Swat3 3) Save and Quit.

The Launcher doesn't do much until you hit one of those 3 buttons.


[name redacted] Feb 27 2017 says:

I did scans with Avast and MBAM, both all ready installed and up to date, and nothing was found.

Typically the windows update issue happens after exiting the game and getting back to the desktop. So save and launch, I'd say. The avast issue happens when I double click on the launcher, but not all the time. Just sometimes.


Slippery.Jim Feb 27 2017 says:

> Typically the windows update issue happens after exiting the game and getting back to the desktop. So save and launch, I'd say

Hmm, do me a favour and before exiting the game alt-tab out and check that the auto update isn't being turned off by Swat 3? I know that Swat 3 saves the config files when you exit the game. The Last Resort launcher shuts down immediately after starting up the game. Anything that happens once the game begins to load is all on the game.

Please Log in or Create an account to join the conversation.

More
7 years 1 month ago #294 by DarkSynopsis

Slippery Jim wrote: Either this person is trolling me or they are mistaken about this behaviour. It is possible his machine is infected but it doesn't have anything to do with The Last Resort mod or it's launcher. Nothing is in the code that is malicious or that could do this sort of thing. I don't even know how this sort of thing would even be achieved other than assuming you would have to modify the Windows Registry. Can you even turn off automatic updates on Windows 10 machines?

If he was simply trolling me you would have thought he would post on various forums. He has just privately sent me messages on The Mod Database website. I have to assume this person legitimately thinks this is happening on his system.


I don't even know where you would turn off auto updates in Windows 10, only had a quick look but didn't see a toggle like Windows 7, I'm sure its possible though.

How would one even know the auto updating is being turned off? does Windows 10 throw up some notification telling you so? Windows 8 did, if so Last Resort/SWAT does not do that on my end.

Does seem like a very odd issue but as you said, hard to believe you would be getting trolled within PMs, seems unlikely it would be tied to Last Resort itself or even SWAT, hmm...

Please Log in or Create an account to join the conversation.

More
7 years 1 month ago #295 by Slippery Jim
Yup, this is the strangest thing I have heard yet.

Last night I Googled how to shut down auto updates for Windows 10 and all I could find was that you could tell it to not download when you are on a metered account like wi-fi. I couldn't find anything else.

I assume he is using Windows 10. I PMed him back yesterday asking what OS he is using.

Please Log in or Create an account to join the conversation.

More
7 years 3 weeks ago - 7 years 3 weeks ago #296 by Slippery Jim

Slippery.Jim Feb 27 2017 says:

Additional question: what version of Windows do you use?



A few days later...

[name redacted] March 2 2017 says:

I use Windows 7 Home Premium 64 bit.

I just ran Last Resort without the launcher and it didn't turn off Windows Update. That meant just double clicking on the .exe in its program files directory, naturally. It does still mess around with the brightness settings though. Brightness is turned all the way up when launched, and then when I exit it's back to my usual settings. This happens when running it through the launcher too. And when I check brightness settings in the menu it's at 0% and can't be turned down, so I have to use the shortcut keys for brightness settings on my keyboard to lower it while in game.


[name redacted] March 2 2017 says:

I might add that I tried the Last Resort launcher again and it didn't switch off Windows Update this time. These issues started more or less after a Windows Update was installed, and I also had some issues with my Wireless connection manager at that time. I haven't found anything malicious on my PC, so I'm not sure what to think. I think it's related to something different. I know some anti-virus programs, from experience, might do something like this for some reason, so I tried resetting Avast to factory defaults. It wouldn't even scan before I did that -- probably because I changed something in scan settings, which Avast themselves recommend you not do (it's obviously pretty sensitive). And yes, it is a genuine copy from the developers themselves.

Please Log in or Create an account to join the conversation.

More
7 years 3 weeks ago #297 by Slippery Jim

Slippery.Jim March 4 2017 says:

The only thing that I can think of (if it isn't malware on your system) is to re-install all your motherboard drivers (video, sound, lan, etc). It is possible something got corrupted.


[name redacted] March 4 2017 says:

Yeah, it happens at other times with other applications. It says that windows auto update is disabled, but then I checked it in settings and it isn't. Avast does this sometimes too, and Avast acknowledges that it is a bug. It claims that real time shields are off when in actual fact they aren't.



At this point I have concluded that The Last Resort mod had absolutely nothing to do with his issues.

Please Log in or Create an account to join the conversation.

Moderators: DarkSynopsis
Time to create page: 0.185 seconds
Powered by Kunena Forum