BREAKING NEWS: TSR INSTALLS SPYWARE!

[Drakron]

That does not mean by itself that its spyware Sigmund , EA lancher and FUCKING STEAM do exactly the same thing ... of course STEAM is in fact spyware as it does record your activity and reports it back (Valve let that up slip when they started to talk about how long did people played HL and how many finished the game).

FAILshop likely just connects to the interwebs in order to throw those TSR ads that were reported (the Launcher does the same thing).

[Doc Doofus]

It may not mean that it's spyware...  But it is fucking arrogant.

[Nightmare]

We bring you the shocking news of the latest TSR atrocity: SPYWARE AND VIRII!
<snipped pic>
They say a picture is worth a thousand words, so have at it.

Which DLL modifies? can you post the details?

[Sigmund]

You might not consider it spyware, but users who have tried it may not agree.

I had read Pescado's threat at MATY and decided to run my Panda Security before and after I installed the tool, besides I took away my internet connection to prevent the program from homming phone. Panda found nothing before installation of the tool, however, as soon as it was installed - two suspicious files aka spyware appeared in the scan.

Regardless of what it's called, a program that needlessly requires to be connected to the internet and installs dubious files onto my system is too close to the "spyware" definition for me.

[pantherpirate]

-When launching the program, the  "Attempts to communicate with the internet" alert popped up. This is so the program can show you the latest subscriber downloads available on TSR, as well as offer you 30% off a subscription.

That is so tacky.    At first I hated EA for opening that store, but now this has put things in a different perspective... I mean, after all it's their game to FUBAR as much as they want (which I'm afraid they already have quite a bit). But TSR profiting off of a game created by completely different group of greedy douchebags is incredibly stupid... and thus shows a cycle of greed that poisons our world.  

[Drakron]

You might not consider it spyware, but users who have tried it may not agree.

Just like there are people that brought laptops to play The Sims 3.

Lets go with the dictionary then

 
   1. Software that secretly gathers information about a person or organization.
   2. Any malicious software that is designed to take partial or full control of a computer's operation without the knowledge of its user.

Regardless of what it's called, a program that needlessly requires to be connected to the internet and installs dubious files onto my system is too close to the "spyware" definition for me.

So far I seen no evidence that FAILshop does either, adding itself to the startup and using Internet connection in order to display announcements is not enough for it to be called spyware and unless you have evidence that it does ... its not.

Also getting malaware is pretty easy, only needs one banner with it embedded on it to get contaminated.

In fact, some years ago the Bethsoft forums ended up with a image file with a embedded virus that proceed to infect everyone that visited the site and I am talking about a reputable software developer (of shitty games) and publisher (of shitty games).

(edit: forgot to write virus ... what a dumbass)

[Lerf]

And there have been a lot of complaints recently that many of the third party ads on TSR are apparently themselves infected with viruses and trojans of various sorts.  So if these are the ads that the launcher is opening you may be in danger of malicious infection even if TSR itself isn't doing it.

[Delphy]

I asked this before on MTS and never got a satisfactory explanation other than Pescado claiming that I do not know how to look at the internals of my PC and figure out what runs on startup, which I can assure you I do.

So, the question is; What, exactly, is this supposed to "install to run on startup"?  Becuase I've looked, and I can't find a single thing.  Absolutely no evidence of anything TSR related running on startup or otherwise unless I load the TSR workshop, which obviously then gets the ads and latest uploads so on.  msconfig shows nothing, and neither does the much more in depth autoruns.

[Witchboy]

I agree with Delphy. I've seen no spyware what so ever in this tool. I've scanned before install & after. The tool is not in my user start up & does not load with windows. Though it does connect to the net like the EA launcher & throws TSR updates, links etc when running it.

[Ambular]

According to jfade, who says he also used a packet sniffer to double-check exactly what the thing does, Trend Micro Internet Security is known to throw false positives for a number of programs with similar functionality.  He says, and I quote, that the Workshop "accesses TSR to download an XML document that tells if there's a new version as well as other news about the tool.  Downloads 4 JPG images.  THAT'S IT."  Also, it can be successfully blocked by firewalls, etc.

I am inclined to believe jfade, as he has never given me reason to doubt his word, so I will probably download the thing when I find a need for it.  YMMV.

[J. M. Pescado]

Jfade is clearly not familiar with the many techniques which exist for sending messages without including the content of the message in the actual message, however. That is the obvious approach that would be used in such a scenario, which is why it escapes packetsniffing. Everyone knows that everyone and their dog has access to a packetsniffer, and if you want to hide a message in a transmission, you cannot obviously place the message in the transmission, and even encrypting the message so it looks like gibberish is suspicious: You have to hide the message in the metadata of the transmission. A pattern of seemingly innocent requests, a specific timing of requests, or even the fact that the request was made at ALL can all constitute a message hidden from plain sight. You can clearly see that this is happening, because the message is not apparently inside the actual transmission. The fact that it has been hidden in such a manner proves its malicious intent.

[rufio]

Trend Micro Internet Security is known to throw false positives for a number of programs with similar functionality.

Well, this much is true.  For a while, Trend did not let TS2 run for some reason, and I had to turn it off to play.  (This has since stopped, either because of a better version of Trend, or because I installed AL.)  It has occasionally tried to tell me that various other games are problematic too, but I don't remember if those were the exact error messages.

In any case, I wouldn't trust a TSR program just on principle, and I'm not impressed by the amount of TSR-related ads in it either.

[Doc Doofus]

I haven't messed with the new TSR program, and probably won't.  But is it in anyway sneaker than something that can be just shut down by cutting it off at the firewall?

[Cupcake]

Toma$$ is sticking to his story that it is equal to the Sims 3 Launcher, which yes, I do consider malicious. I did not ask for your sodding adverts, and I will choose what I do with my computer without TSR telling me it MUST have access to my Internet connection and waste my bandwidth, to feed me complete shit.

And as for cutting it off at the firewall- who says it will run if it has no Internet connection?

[dedust]

Mmmm.

Too bad for TSR I don't use Windows. EAxis should've made the game run better on OSX, so we should't have to worry about poo on our systems.
Lovely though 

[Leticron]

For what it's worth, I ran some tests on the latest TSRW.exe 07/24/09
MD5:521605E8B73BA0BD98AD72CFF3AD14D0
CRC-32: A3952AF2
Neither Jotti (0/21) nor VirusTotal 0/40) found anything.
During Installation both parts  (SlimDX and TSRWorkshop.exe) asked for net access, which I had blocked.

Next I tested the just installed TSRWorkshop.exe
MD5: 84D590202FC53AA752831288D0775BBC
CRC-32: 155F574A
on VirusTotal (0/40) and on  Jotti (0/21)
The program started and seemed to work (I'm no modder so don't take my word for it).

Conclusion: Either the Program itself has been modified after Pescado's discovery or the warning was a hiccup on TrendMicro's side and the scanstrings have been updated/adapted/corrected accordingly.

What I didn't test was, if the program loads any unwanted payload after it's given net access.
After uninstall 101Reg-keys were left (mostly under HKEY_LOCAL_MACHINE  which also includes the now obsolete firewall settings to block this prog. and HKEY_CLASSES_ROOT those were mostly Installer related).
As expected with runtimes SlimDX hat to be uninstalled separately.

-le

[Nightmare]

Jfade is clearly not familiar with the many techniques which exist for sending messages without including the content of the message in the actual message, however. That is the obvious approach that would be used in such a scenario, which is why it escapes packetsniffing. Everyone knows that everyone and their dog has access to a packetsniffer, and if you want to hide a message in a transmission, you cannot obviously place the message in the transmission, and even encrypting the message so it looks like gibberish is suspicious: You have to hide the message in the metadata of the transmission. A pattern of seemingly innocent requests, a specific timing of requests, or even the fact that the request was made at ALL can all constitute a message hidden from plain sight. You can clearly see that this is happening, because the message is not apparently inside the actual transmission. The fact that it has been hidden in such a manner proves its malicious intent.

PEs, provide an scientifical way of reproducing your input, otherwise I´ll have to discard this news as false. I will feel backstabbed, as I´ve trust you many times and now I feel there´s no scientifical substance here.

*back to my Vmware tests*

[J. M. Pescado]

For what it's worth, I ran some tests on the latest TSRW.exe 07/24/09
MD5:521605E8B73BA0BD98AD72CFF3AD14D0
CRC-32: A3952AF2

I get an entirely different md5sum, 51e41f48f7aceef99c3ed57f0e072e2c for TSRW.exe, meaning your version is newer and has been altered, probably to better hide the evidence now that they know they have been caught. They are probably using a new trick that fools your particular scanner.

PEs, provide an scientifical way of reproducing your input, otherwise I´ll have to discard this news as false. I will feel backstabbed, as I´ve trust you many times and now I feel there´s no scientifical substance here.

I'm not exactly sure what you want. You want me to provide a demonstration of steganographically concealed transmissions in innocuous data? Just look at the Splotch Creatures. They are PNG files. Totally harmless PNG files. If you examined them, you would find harmless PNGyness. But they contain DATA in them and can be used to reconstruct a Splotch critter. Admittedly, this is a completely benign implementation done for reasons unrelated to nefariousness, and the fact that it is not nefarious is why we know of it, as the game never really attempts to conceal this fact from us. TSR, however, is known to be a nefarious operator: They have acquired and then misused or released to third parties personal information from users in the past. It is reasonable to say that they do so regularly and there is absolutely no physical reason why they would have stopped, and therefore, there is every reason to believe the practice continues. In fact, on PMBD, Johan himself came over to gloat about how undetectable his new system was, because he just couldn't resist the temptation to brag and gloat smugly.

[Leticron]

I get an entirely different md5sum, 51e41f48f7aceef99c3ed57f0e072e2c for TSRW.exe, meaning your version is newer and has been altered, probably to better hide the evidence now that they know they have been caught. They are probably using a new trick that fools your particular scanner.

That's why I included the checksums to begin with . Additionally I wasn't able to find any evidence of "run at startup" in this version.
I checked with msconfig, autoruns, Hijack This and manually via regedit (clearly I have way too much time on my hands  ).
Security software installed here includes Avast, Ad-Aware and Mark Russinovich's Rootkit Revealer.

Again mind you, the program was never allowed to connect, so I have no idea what it might have done/loaded/installed after contacting its home server.
So until someone finds more evidence, the program in its present form appears to be safe to use .

-le

[Rhayden]

I posted a link to this thread on GOS but apparently it got deleted.

Simsecret is open until Friday.

Bah, SimSecret. MSTY is vastly superior.

[uknortherner]

I posted a link to this thread on GOS but apparently it got deleted.

Simsecret is open until Friday.

Bah, SimSecret. MSTY is vastly superior.

Meh - SimSecret actually updates though.

[rufio]

Yes, but recently SimSecret basically boils down to

<GOSling> sucks!
STFU, <GOSling>
GOS sucks!
GOS rocks!
Jenfold sucks!
Jenfold rocks!
I love your legacy!
I hate your legacy!
Simsecret sucks!
Everyone sucks!
<Sims Forum> sucks!
<Sims Forum> rocks!

Seriously.  Every single fucking week.  Jesus Christ, no one cares anymore.

[uknortherner]

Problem is though - MSTY seems to be exclusively MATY secrets, and 99% of those relating to Retardoland, and not really secrets at all.

SimSecret is certainly not as good as it used to be, it has to be said. Recent submissions could be broken down into four categories: Spam, GOS hate, Pretentious Shit and MATY. There's also a fifth category that turns up occasionally: Everything Else.

[Lorelei]

Also: Morrissey sekrits.

[Rhayden]

I posted a link to this thread on GOS but apparently it got deleted.

Simsecret is open until Friday.

Bah, SimSecret. MSTY is vastly superior.

Meh - SimSecret actually updates though.

So submit secrets so we can post them. Do something instead of just bitching uselessly.