Command and Conquer: Renegade Official Forums - RDF feed
C&C: Renegade --> Dying since 2003™, resurrected in 2024!
I recently have had a problem and I posted it in the =[UN]= forums for asistance.(posted there because I did not suspect it was RG at the time) RC22Fires in UN forums I simply turn off my computer for 3 hours because thats usually all the sleep I need. Guess what I get when I turn it back on. Seems I can't delete it ffs. Sigh :-[ Hey look norton has more to say! Yikes thats not good. FFS Oh and to top it all off ever since this started I can't start renguard. - This is all I get when trying to start RG. OMFG What do I do? Hmmmm and what happend was I got some very nice replys. One of the 1st ones I got worked. Enforcer's reply in UNforums http://securityresponse.symantec.com/avcenter/venc/data/hack tool.rootkit.html READ FOLLOW THE INSTRUCTIONS CAREFULLY You see these virus messages I got apeared yesterday and I followed the instructions and quarantined it. Had no problems. Until I started Renguard again. I got the message right when I double clicked game.exe So I told a buddy clan member of mine and said he haid the same problem. I managed to ask him when it occured. He said yesterday. ZOMG when it happend to me. His Renguard was starting for him and he did not get "failed to initialize" message as I did. What he did was reinstall Renguard and now he is not getting the virus alert messages. I am going to reinstall Renguard now. If this works I will postreply. If it does not I will probally postreply.
Re: HELP ME OUT BEFORE I LOSE MY MIND. WORM THROUGH RG?
Ok I talked to my clan bud again. He said that his Norton try icon was there but it wasn't actually loaded. After moving cursor over vanished and anyway once again it happens only when starting Renguard. At least he can play ffs.
No it doesnt. The "couldn't initialize service" error is a firewall problem.
Parad0x wrote on Thu, 20 October 2005 12:26 No it doesnt. The "couldn't initialize service" error is a firewall problem. How could it be a firewall problem when I have not configured or changed my firewall in anyway before this started happening. Also It can't be a firewall problem because right before this message comes up game.exe doesn't even become a process for a milisecond. IE it does not come on at all. Renguard needs to be able to initialize before it can try to connect. No sorry, I was not specific. The screenshots I previded were, You were not talking about what I am talking about. I know what error you mean. I am talking about Error: loader couldn't initialize service!
Some other people got that too since yesterday.
Ma1kel wrote on Thu, 20 October 2005 12:54 Some other people got that too since yesterday. Well that is VERY interesting.
I also have a problem with this happening. Only my situation is a little better. Although each time i start renguard Norton Anti-virus warning pops up and says virus found called Hacktool.Rootkit, i can still play renegade with renguard. Seems a bit strange that this virus would be detected only after renguard is starting up and at no other point in my computer running... This started just yesterday and i have made no changes to my firewall or Norton. I have restarted my computer and reinstalled renguard with the same thing happening after i did both.
your not the only one that I know of that is having this problem. I don't see any comments from mac or Crimson though that would shed some light on this.
This was earlier in #bhs_support on IRC. [16:55:48] <@Crimson> It's Norton FFS [16:55:58] <@Crimson> Norton must have sent out a new update [16:56:17] <@Crimson> Some virus writers use SVKP to pack their viruses because it makes it harder to reverse engineer [16:56:26] <@Crimson> No one is getting infected
My norton antivirus has detected this and its says it found a hacktool.rootkit in windows/system32/SVKP.sys and it only happens when i try and run renegade through renguard, i uninstalled it and i can stil play ren without renguard, i reinstalled renguard and it still doesn't work, i stil get the same error message and a box "loader cannot initiliaze loader (or service don't remeber which one)" its definately not my firewall for two reasons, a i haven't changed anything, and b its an external firewall protecting my home network so it isn't even on this comp. I also tried reinstalling renegade and found that its a renguard problem, and only happens when i try and use renguard. I'd appreciate it if someone from the renguard team or anyone could help me with this problem.
I'm not sure exactly why we're seeing this so often recently. My guess is that the most recent virus definitions file that Symantec put out for Norton's Anti-Virus doesn't like SVKP, which is a service necessary to run RenGuard... In any case, you should first scan your computer to make sure that you do not have any viruses. When you are confident that you have no viruses, you can then tell Norton's AntiVirus to remove SVKP.sys from the Quarantine list. I will detail the instructions for that shortly, for Norton's Anti-Virus 2005. If SVKP.sys is not in your Quarantine list, then you must reinstall RenGuard (and you can probably thank Symantec for that). To remove SVKP.sys from your Quarantine list, double-click on the Norton's Anti-Virus icon in your system tray (next to your clock). When NAV has finished loading, on the left you should see a links. I have "Status", "Scan for Viruses", "Reports", and "Advanced Tools". You should click on "Reports". Then, in the top center of the window should be an item named "View Quarantined Items". Click on that. This will bring up a new window showing exactly what files Norton's Anti-Virus has quarantined. Look for an entry with a file named "SVKP.sys" with a threat named "Hacktool.rootkit". Right click, and select "Restore". If all goes well, then Norton's Anti-Virus should not complain about SVKP.sys anymore (unless Symantec does this again). And again, RenGuard is not a worm, a virus, a backdoor, or any other malware. I can personally guarantee that. Edit: If the RenGuard loader still couldn't initialize the service after removing SVKP.sys from your Quarantine list, then you will most likely need to reinstall SVKP.sys (which can be done by reinstalling RenGuard).
I reinstalled renguard and deleted the SVKP from the reg as one of the stickys put as a possible solution.....nothign works i still get a "loader cannot initilize service" message
I got my RG working and got rid of Norton.
Ok..I have already done the same thing and removed it, i have reinstalled renguard and restarted my computer the detection of virus warning STILL COMES UP and now i CAN'T EVEN PLAY THE GAME JUST LIKE RC22FIRES . Before that it would just come up i click OK twice and the game plays with renguard. Now, i get: "Error:Loader couldn't initialize service!" i click ok and im back in GSA lobby. Wonderful, now i will probably get forced from each server i attempt to play because i will be playing without renguard. Another problem that has started after this problem with a virus that is detected when i start renguard is that whenever i click the desktop icon of renguard it brings up a message saying "About to restart." My computer then restarts and before logging into my account on Windows XP it stops at welcome and brings up the installer for renegade demo! So, i can't play from GSA with renguard and i can't get to renegade to play westwood online. Before we just say its Norton lets look over all the possible problems...suggestion maybe Renguard, dunno just puttin it out there
You all "seem" to get infect at the same time because you all use norton. People that arent running the crap that is norton dont have this problem.
Parad0x wrote on Thu, 20 October 2005 16:11 You all "seem" to get infect at the same time because you all use norton. People that arent running the crap that is norton dont have this problem. Shut up. I've never had any problems with Norton's Anti-Virus.
SVKP was infected on my laptop and I haven't even ran RG in months on that...
Lotsa people around me have the problem. Definately a Norton problem!
I has this problem too! I have solution found like it again go! My English is not so good unfortunately!
It's Norton - they released their latest liveupdate definitions this morning - we downloaded them like good boys and girls and here we are. I have just spent ten minutes on their site trying to find somewhere to leave a Q for their support staff - remarkably there is no where to do this that I can find. I am not a techy in any way and have no solution to offer - just the reassurance that it is not renguard causing a problem rather Norton - IMHO - it is too coincidental for it not to be. Gulp! I can play just by clicking the game2.exe file - but obviously without renguard - so I am snookered for all but the server I pay for. However one of the ways we police the server is to !forcerg peeps - hence we are a bit exposed to accusations of hypocracy if all the clan play with no renguard etc. Bit of a conundrum really. BHS have not caused this and it is a Norton caused issue and yet how to contact Norton to get them to undo the damage? Any helpful suggestions would be gratefully received. None of the fixes above work BTW - I have tried them all and get the error:failed to initialise loader error all the time. Damn - just as the weekend is coming up as well. Goztow wrote on Thu, 20 October 2005 15:34 Lotsa people around me have the problem. Definately a Norton problem!
you could try this http://www.grisoft.com/doc/40/lng/ww
I quarantined it and everything seems to work fine. When I start RG it still gaves the "you have a virus" message, but when I look into the location of the file I find that it isn't actually there, but rather still quarantined. After that everything works normally.
Kanezor wrote on Thu, 20 October 2005 13:44 I'm not sure exactly why we're seeing this so often recently. My guess is that the most recent virus definitions file that Symantec put out for Norton's Anti-Virus doesn't like SVKP, which is a service necessary to run RenGuard... In any case, you should first scan your computer to make sure that you do not have any viruses. When you are confident that you have no viruses, you can then tell Norton's AntiVirus to remove SVKP.sys from the Quarantine list. I will detail the instructions for that shortly, for Norton's Anti-Virus 2005. If SVKP.sys is not in your Quarantine list, then you must reinstall RenGuard (and you can probably thank Symantec for that). To remove SVKP.sys from your Quarantine list, double-click on the Norton's Anti-Virus icon in your system tray (next to your clock). When NAV has finished loading, on the left you should see a links. I have "Status", "Scan for Viruses", "Reports", and "Advanced Tools". You should click on "Reports". Then, in the top center of the window should be an item named "View Quarantined Items". Click on that. This will bring up a new window showing exactly what files Norton's Anti-Virus has quarantined. Look for an entry with a file named "SVKP.sys" with a threat named "Hacktool.rootkit". Right click, and select "Restore". If all goes well, then Norton's Anti-Virus should not complain about SVKP.sys anymore (unless Symantec does this again). And again, RenGuard is not a worm, a virus, a backdoor, or any other malware. I can personally guarantee that. Edit: If the RenGuard loader still couldn't initialize the service after removing SVKP.sys from your Quarantine list, then you will most likely need to reinstall SVKP.sys (which can be done by reinstalling RenGuard). THANK YOU! Kanezor!!!!!!!!! Worked for me! Great instructions! Never running Norton's AGAIN ! TKO
if you want can I times try the solution to posts!
You need a new svkp if you get "Error: Failed to inialize service!" message.
Please let me know when you have it as I cannot currently play Renegade due to this problem - Big annoyance as I am a good sniper so if I do not have renguard - Booted immediately. Yes, definitely a norton/renguard/svkp.sys issue - Curses ... Withdrawel symptoms until a resolution is in place.
The solution of the problem is simple! 1.Deinstal Renguard 2.Go to Registry Editor (Start > Run > Regedit) Search for "SVKP" and delete the folder! (HKEY_LOCAL_MACHINE\SYSTEM\Contralset001\Service\SVKP) 3.reboot your PC 4.Start Norton afterwards " Mauelle Prüfung" and "Ausschlüsse" Then on "NEW" and "c:Windows/system32" and presses on "OK " 5. Install Renguard You can start it now without problems!
Yes, lets all ignore system32 folder to scan - VIRUSUS - Open door here, come on in.
Afterwards can you the entry (c.windows/system32)delete! Afterwards ersaetzt you the entry by exactly the file c:windows/system32/SVKP.sys ! That cannot be done before! Then leave norton only this file out! better so!
I tried that just to test but ... No go, it is still seen as a trojan and blocked. SVKP.SYS needs to be rewritten.
well even though that wasn't in english and was inviting some virus to come and infect ur system, it worked (note u could also just turn off auto-protect and have to do all scans manually lol) so uhh thanks, but i'l come back to haunt you after ur solution gets my comp infected j/k
I deleted also still the virus from the isolated elements Much-calibrated must you also before make
You guys should realy decide to get better anti virus.http://www.free-av.com/
SVKP is a protection software that makes things harder to reverse engineer. A great idea for RenGuard, but also a great idea for virus writers who want to hide their code. So, because some virus writers use SVKP, Norton (stupidly) marked this as a virus, even though it's not and never was. I hope you can all get your Norton fixed not to detect this.
Ok, I've been playing Renegade for quite a while using Renguard without any major incidents....until now. I'm just going to load up GSA and find a server like usual, except I get an error message along with my Norton Internet Security that I have a virus on my system. I've attached the picture of the error message to this. Now I thought at first that this might be affecting everything. But when I tried to access other programs like Internet Explorer, other games i play online, or just even other crap, NOTHING happens. This only occurs when I try to access the Renguard network. Also, I attached a picture of what Norton says this virus is supposed to do. What it's supposed to do throws me off a little. Who would take the time to find a way to block me out of Renguard? I'm not a huge tech person, so I don't really know all of the possibilities on what could've happened. My guess (which is completely without evidence) is that someone who has played Renegade with me before doesn't like me...and just decided to send me a present to be an asshole. Like I said, I don't know. Hopefully you guys may know something I don't. Anything at all will be helpful. I will exhaust every possible option before I'm forced to do a system restore. If there's some way you can track something through the Renguard network like this, you guys would be the ones to ask.
Looks like plenty of others are having the same problem......
i got just the same problem .. it happenned 2 days ago first time .. n still goes on .. see screenshot below ... http://www.mmylo.com/rg.jpg
yeah same here i have exacly the same problem http://img483.imageshack.us/my.php?image=rgvirus8nz.png i got the error message as well just not in screenshot
It makes as described by me! 1.Deletes the entry in the isolated elements! 2.obeyed after it the 5th steps which I above shouting-smooth has. 3.thus can do it norten nevertheless to keep
If you are still getting the service error, you need to do the following. 1) Open command prompt. 2) Type the following without quotations "net start SVKP" 3) Restart your computer.
Or reformat....lol
I tried using the command prompt and put that in (along w/ restarting), but nothing happened. Still getting the same error message.
I wish I read this sooner, I deleted renguard, and have been running diagnostics on my computer for two days. Even posted my HiJackThis logs on Tweakxp. Good to know it wasn't just me. Am I correct in understanding your advice here Crimmy? That we simply ignore the hacktool.rootkit warnings and just play?
Well, I've uninstalled RenGuard and excluded the SVKP file in Norton Anti-Virus. But that was after I had already quarantined the file and then deleted it from quarantine. And now it still won't work. I get the GameSpy error message, but not the Norton one, which is a start I guess. I still have the RenGuard installer and I've tried reinstalling it multiple times. But the SVKP file never shows up in my system32 file.
Nobody is getting "infected". Norton has simply added SVKP to their list of antivirus definitions, most probably because some real virus or worm they found was packed with SVKP. So everyone using NAV who updates their definitions seems to be "suddenly infected". SVKP has been part of RenGuard all along, and is nothing bad. SVKP is a protection that RenGuard uses, it basically encrypts renguard so that people cannot easily hex edit it or use debuggers on it and otherwise reverse engineer it so they can bypass it. Sadly apparently someone used SVKP to protect some malicious program that Norton analyzed, so instead of fingerprinting that specific worm, they added svkp.sys to their blacklist...pretty silly but ah well what can we do. Again, I say, SVKP is NOT a worm, virus, trojan, or anything bad. It is part of RenGuards protection. BHS paid money for SVKP. It is protection software, not a "hacker tool" or backdoor program. If you remove svkp.sys, RenGuard will cease to function. The recommended way to get around this "problem" is to, as posted, remove svkp.sys from the norton quarantine list. Another option is to not use Norton, but for all we know Norton shares their virus definitions with others and svkp will show up soon for other antivirus programs. This isn't really a big deal, the important things are that svkp.sys is not anything malicious, and all antivirus programs have a way to add programs to a "whitelist", so you don't get constant warnings.
ok if i am readin this correctly - norton is causin this hacktool thing thru svkp - an ya'all are suggestin that we allow it by forcin nortons to ignore it - hmm now my question is - what about the actual viruses or worms or what ever that are usin svkp - if we allow it then we might as well as throw all our anti virus programs away and let the infections begain so what am i supposed to do i wont throw my antivirus away nor will i force it to allow svkp. this seams like a problem that you guys need to address and repair versus puttin your hands over your eyes and sayin to ignore it i trust your program - its a pain at times but very functional and i commend you all on it - but i am forced to not use RG till YOU fix it bummer too - i really liked it thanks alot for everything and good luck on this one gny
For 2 days i was battling this hacktool problem and i finally said screw it.Well because I could play without renguard I went to nonoobs and started to play,10 mins in with 4 kills I got !rg and kicked,2 of my kills were remotes when they stormed the ref.I just thought that was funny,but now I am up and running and fixed thanks for this forum's input and symantec's. THX AGAIN XXREDRUM
Alright: Norton AntiVirus just complained about SVKP.sys for a second time on my machine (eg, after I had solved the problem locally), so it seems like this isn't going to go away easily. First up: Go complain about this problem to Symantec. They caused the problem. https://secure1.symantec.com/discuss/support/feedback2.nsf/p roduct+feedback Now that that's said, let's get RenGuard working again. That is, working until Norton AntiVirus decides to fuck it up again. My instructions will be very specific, so if you fuck up, it's your fault. Also, these instructions will require two reboots. 1) Let's add SVKP.sys to Norton two exclusions lists. 1a) Open Norton AntiVirus. 1b) Click on "Options" at the top of the window 1c) On the left, under "System", click on "Manual Scan" 1d) Two items will appear under "Manual Scan", click on "Exclusions" 1e) On the right, click "New" 1f) Type in "C:\WINDOWS\system32\SVKP.sys" 1g) Click "OK" 1h) Click "OK" 1i) Click "Options" again 1j) On the left, click on "Threat Categories" 1k) Two items appear, click on "Exclusions" 1l) On the right, click "New" 1m) Type in "C:\WINDOWS\system32\SVKP.sys" 1n) Click "OK" 1o) Click "OK" 2) Now that SVKP has been added to Norton AntiVirus's exclusion lists, we'll need to make sure that it's also not in the Quarantine list. 2a) On the left (Norton AntiVirus should still be open... if not, open it again you silly!), click on "Reports" 2b) In the top center, click on "View Quarantined Items" 2c) Look for an item in the list with a file name of "SVKP.sys" and a threat name of "Hacktool.rootkit" (or something very similar) 2d) If you find an item in the Quarantine list which matches the description, then right click it and select "Restore" 2e) When you're finished (or if you did not find anything in the Quarantine list that matches the description), close the Quarantine list, and close Norton AntiVirus. 3) Because Norton AntiVirus is a piece of shit, you will now need to reboot your machine for the exclusions to take affect. So, reboot. This tutorial will be here when you get back. --- 4) Uninstall RenGuard and SVKP 4a) Use RenGuard's installer -- if you do not have it, then re-download it from www.renguard.com! 4b) Click Start -> Run and type in "regedit" to open Registry Edit. 4c) Remove the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SVKP. 4d) Remove the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY _SVKP. 4e) Close RegEdit 5) Reinstall RenGuard (which will also reinstall SVKP) 6) Reboot your machine If you did everything correctly, RenGuard should now work. CorePatch 1 will be redownloaded, even if you already have it installed... silly RenGuard can't see that the files are already from CorePatch 1. Downloading and installing CorePatch 1 again will not hurt anything. If you do not want to wait for CorePatch 1 to download, then you can disable it from RenGuard's options window. Also remember than when installing CorePatch 1, the error 17 at the end is fine.
HTGunny wrote on Sat, 22 October 2005 11:27 ok if i am readin this correctly - norton is causin this hacktool thing thru svkp - an ya'all are suggestin that we allow it by forcin nortons to ignore it - hmm now my question is - what about the actual viruses or worms or what ever that are usin svkp - if we allow it then we might as well as throw all our anti virus programs away and let the infections begain Norton AntiVirus should NOT disable LEGITIMATE services to disable viruses! That is just plain STUPID. It would be like not using Windows because a specific virus only runs on it! That's stupid. If you're not going to use Windows, make it for a halfway-decent reason: you don't trust Microsoft, you can't afford Windows, someone gave you something else, etc etc. Disabling LEGITIMATE services to disable viruses makes it so that people who payed real money for the service are then not able to use the service they paid for! BlackHand Studios payed for SVKP to help protect it from crackers. Now Norton AntiVirus is making RenGuard useless without solving the problem that RenGuard does solve. Norton AntiVirus is hurting the C&C Renegade community, a legitimate game-playing community with people whom have paid money for the game, the gameservers, the anti-cheat services (some of us), and (many of us) have spent a lot of time for the community as a whole.
HTGunny wrote on Sat, 22 October 2005 12:27 ok if i am readin this correctly - norton is causin this hacktool thing thru svkp - an ya'all are suggestin that we allow it by forcin nortons to ignore it - hmm Yes. HTGunny wrote on Sat, 22 October 2005 12:27 now my question is - what about the actual viruses or worms or what ever that are usin svkp - if we allow it then we might as well as throw all our anti virus programs away and let the infections begain Norton is detecting svkp.sys as "Hacktool.rootkit", which is just a generic classification of "we think this is a tool that hackers might use". It is more of an informational/caution message than an actual virus hit. What I mean to say is, by telling Norton to ignore svkp.sys, you are not making yourself vulnerable to viruses or trojans that use svkp, because Norton would fingerprint that specific virus, and there would be a special definitition for it like "rootkit.w32SomeTrojan". Antivirus scanners mostly work off of "fingerprints", which are CRC/checksums of parts of files. If a real virus was released that used svkp, Norton would not rely on just finding svkp.sys to detect it, it would have a fingerprint of the main virus executable itself, so you would still be protected. HTGunny wrote on Sat, 22 October 2005 12:27 so what am i supposed to do i wont throw my antivirus away nor will i force it to allow svkp. this seams like a problem that you guys need to address and repair versus puttin your hands over your eyes and sayin to ignore it It depends on if you want to be a sheep and go along with Nortons idiotic claim that anything that uses SVKP is bad. That's like saying a C compiler is bad, because virus and trojans are compiled with one "Detected Microsoft Visual Studio.Hacktool.rootkit!". We paid money to license SVKP because it's the best at what it does. If we use some other protection, who is to say that Norton won't add it too (and maybe already has). I think its easy to see that Symantec/Norton are the ones who have overstepped their bounds here, and while I would like to think that we could talk to their support people and have the definition removed, I doubt it, so that means the only course of action that can be taken is by you HTGunny wrote on Sat, 22 October 2005 12:27 i trust your program - its a pain at times but very functional and i commend you all on it - but i am forced to not use RG till YOU fix it As I said, there is nothing *we* can fix. The only way that we could try to fix it, is to not use SVKP, or any other sort of protection in the next version of RenGuard. Sadly, if we did that, RenGuard would get hacked in about 30 seconds from release. I don't really have time to explain in detail, but suffice to say that RenGuard without SVKP or something similar, would be like RenGuard being a renguard.txt, with one line that says "hacked=false", that someone could just edit to say "hacked=true". HTGunny wrote on Sat, 22 October 2005 12:27 bummer too - i really liked it thanks alot for everything and good luck on this one I understand your frustration and believe me, nobody is more frustrated than us. We will continue to try to find the easiest solution, but in the meantime we recommend making Norton ignore svkp.sys. We would not make this recommendation if we thought it would expose your PC to other harms.
Norton sucks now a days, I visit a forum with pro hijack this loggers, and most of the time Norton is just sleeping while those ad-aware,malwarem, trojans are running and it's a memmory hoggin program too. But yeah it sucks for the people who can't use RG now, maybe symantec should bring out a fix
quote by: -TG-Lammy Quote: The solution of the problem is simple! 1.Deinstal Renguard 2.Go to Registry Editor (Start > Run > Regedit) Search for "SVKP" and delete the folder! (HKEY_LOCAL_MACHINE\SYSTEM\Contralset001\Service\SVKP) 3.reboot your PC After that i Reinstalled Renguard with norton disabled. This worked for me, i just started having the problem after Norton autoupdated. I also Put the file in the exclusion list and i have no more problems.
I have SAV 10 (Corporate Edition) and was hit by this crap too. I put svkp.sys in the exclusion list and reinstalled RenGuard, but when it goes to reinstall the core patch 1 it freezes up. Is the site down or is it because it is already on my system? I disabled core updates for now.
SuperTech wrote on Sat, 22 October 2005 15:20 I have SAV 10 (Corporate Edition) and was hit by this crap too. I put svkp.sys in the exclusion list and reinstalled RenGuard, but when it goes to reinstall the core patch 1 it freezes up. Is the site down or is it because it is already on my system? I disabled core updates for now. This sounds like a different problem than the current one, so idk... However, the svkp.sys issue does seem to be the fault of Symantec...they should be able to scan into svkp protected files in the first place...
Are you sure nobody is getting infected? When I got this norton problem what i did was highlight svkp and all it said was "svkp.sys" When I deleted it and replaced it with a good coppy I got what I should have: Description: SVKP Driver for NT Company: AntiCracking FileVersion: 4.0.1341.1 Size: 2.31 KB The first file was of a different size too. It was corrupted. I know a few people with Norton who has not got the problem. Also I have not updated my virus deffinitions in a long time and they don't just update themselves. So I do expect it was a virus going around somehow. I have a fresh svkp. Reformating is NOT the answer. If you have this problem still email me or msg me and I will help you find the solution. rc22fires@hotmail.com : For msn messenger and primary email. rc22fires@yahoo.com : Yahoo messenger. rc22fires : AIM. I have already got 3 people back on Renguard.
Ma1kel wrote on Thu, 20 October 2005 11:54 Some other people got that too since yesterday. I got the same message like u, even if i dont have that mentioned file on my pc :S maybe its something with windose xp, cause on my w2k system its not breaking
why dont you make alink of the svkp.sys file? i wanan download it but ur not online
I attached the SVKP.sys from my own c:\windows\system32 directory.
omfg i even cannot add it sorry guys but my renguard period is OVER AND OUT! It was a great program guys i really enjoyed it. Good work well its over now greetz Recon
Recon wrote on Sat, 22 October 2005 18:06 omfg i even cannot add it sorry guys but my renguard period is OVER AND OUT! It was a great program guys i really enjoyed it. Good work well its over now greetz Recon Have you read any suggestions so you can fix this problem? Also, to revive your renguard shred your norton CD's and uninstall everyting from Norton if you refuse to read them.
Cybie1111 wrote on Sat, 22 October 2005 18:49 Recon wrote on Sat, 22 October 2005 18:06 omfg i even cannot add it sorry guys but my renguard period is OVER AND OUT! It was a great program guys i really enjoyed it. Good work well its over now greetz Recon Have you read any suggestions so you can fix this problem? Also, to revive your renguard shred your norton CD's and uninstall everyting from Norton if you refuse to read them. According to a report from ingram091, other anti-virus programs are picking up svkp.sys as well...
tnx blazer for uploading it. i never thought of that
Kanezor wrote on Sat, 22 October 2005 12:54 4c) Remove the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SVKP. 4d) Remove the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY _SVKP. 4e) Close RegEdit Well, this just isn't working for me.
Recon wrote on Sat, 22 October 2005 19:06 omfg my renguard period is OVER AND OUT! It was a great program guys i really enjoyed it. Good work well its over now LOL...if everyone gave up as easily as you, we would still be in the stone age.
My norton pops up also, but i just ignore it and it still works for me. For all of you that think norton sucks. Have you thought that maybe they are just being cautious, and if your anti-virus doesnt detect programs running svkp.sys then will it detect the viruses using them?
I wrote Symantec a letter. Here is a "How to exclude post" on OZ... http://www.ozclan.com/forums/viewtopic.php?p=16831#16831
Hooray! It works now! But I'm having another problem...if I try to download the Core Patch after starting RenGuard, it won't download.
[BA RANGER wrote on Sat, 22 October 2005 23:34]My norton pops up also, but i just ignore it and it still works for me. For all of you that think norton sucks. Have you thought that maybe they are just being cautious, and if your anti-virus doesnt detect programs running svkp.sys then will it detect the viruses using them? Ranger... give me a break, norton has such a long history of false positives and missing certain viruses that it makes me wanna beat the crap out of every sucker i see who uses it and teach them a lesson not to use NORTON! if you want a GOOD antivirus, use what I use, bitdefender or try kaspersky, not to mention the fact that bitdefender was recommended to me by v00d00 himself! I have found many things since i got rid of norton, i found a hefty pile of trojans, from downloading things I wasn't supposed to be anyway, 1 last word, NORTON SUX!
What if you deleted this one. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SVKP. But won't let you delete this one:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LE GACY _SVKP. It's telling me I can't delete this one.I deleted the other one in controlset 1.
Thanks for the great help you guys offer with this pesky problem. The how to get renguard working again tutorial is very good. I want to add a little thing to that: Most ppl got autoprotect enabled so you must also svkp.sys exclude in the autoprotect during the steps in which u exclude svkp.sys
i just dont get it because i uninstalled renguard added my westwood folder to 2 exclude options at system and other reinstalled renguard and i get the message error intializing bla bla bla
Why do people want a "clean" version of SVKP... It's was never infected in the first place, but only added to a list of files Norton should flag down.
Kaspersky is hella slow when scanning, its worse than norton. NOD32 is one of the best av's to use, it doesn't hog your ram or slow you one bit, plus it has found everything so far. And i have to agree, Norton does suck.
My svkp.sys WAS infected. I could not delete it due to write protection. Its size was more than it should have been. It WAS an infected version. People who have gotten the infected version are the ones who got the Error: failed to initialize service! when trying to start RG. Norton has added it to its bad list because of that virus that was going around. Norton gives you the virus found message even after you have deleted or quarantined the svkp.sys file when starting RG because RG uses the svkp.sys and Norton detects that svkp.sys and RG work off eachother to infect your computer. I have replaced my svkp.sys to get RG working. I got rid of Norton so I don't have to deal with its messages because I personally don't like putting a file used for viruses on a ignore list. Please try this working AntiVirus freeware if you don't want Norton but don't have any idea what you would get instead. http://free-av.com/ Please if you have gotten rid of the Norton problem and you are stuck with Error: failed to initialize server! message when starting RG just: 1. Uninstall RG. 2. Put in a clean svkp.sys to c:\windows\system32(attached) 3. Restart computer. 4. Innstall RG. 5. The core update sometimes fails to download and install itself. Download it from http://www.blackhand-studios.org Also you would wan't the svkp.sys if you have deleted the other one even if your coppy wasn't infected as some were. Well best of luck to all getting back on RG. EDIT: Deleted svkp.sys attachment, as I already attached mine several posts ago in this same thread, and I cannot be certain of the integrity of yours. -Blazer
What is the possibility for rengaurd team to release something that lets renguard run without relying on this windows service?
Alkaline wrote on Sun, 23 October 2005 19:14 What is the possibility for rengaurd team to release something that lets renguard run without relying on this windows service? 0 Hint: Read Crimson's post on this earlier in this thread
thanks blaz - that helped me understand - keep up the good work i will work on gettin it forced gny
I found what appears to be the website for SVKP itself. It appears to be a sophisticated (2Kbit RSA + Rijndael AES) encrypting protector for applications. Link: http://www.anticracking.sk/products_svkp.html
Where do you install the SVKP intaller to.
Would someone help me with this problem.I don't want to fuck anything up.Can someone walk me through step by step and don't leave any important details out.I've tried what Kanezor "said" on page 2 at the end of the page.I went to delete the last HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY _SVKP. and it gave me an error saying that I couldn't delete it. It gave me this error message
{deleted to prevent further flaming.]
Quote: For the record... and I'm sure this too will be deleted, I DID NOT make a hack for RG. I recompiled BHS.dll to disable PAMSG function so that the dam RG message didnt pop up every 5 mins in half RG servers when you were not running RG. I did this cause it was GOD DAM ANNOYING to have it pop up every 5 mins and RG would not work on my system anyway as I run Windows 2000. I posted the file when the antivirus thing started happening cause I figured others would want to get rid of RG too (till you fixed the problem... BIG SURPRISE. your not gonna), as I have and only play on Half RG systems. seeing as pamsg works for clients without bhs.dll, u would need to edit Renegade u sure did your research huh?
=HT=T-Bird wrote on Sun, 23 October 2005 20:47 I found what appears to be the website for SVKP itself. It appears to be a sophisticated (2Kbit RSA + Rijndael AES) encrypting protector for applications. Link: http://www.anticracking.sk/products_svkp.html Excuse my french, but NO SHIT! As I have been saying SVKP is part of Renguard, BHS has a paid license for SVKP. It is an integral part of RG's protection. I wish everyone would stop trying to "uninstall" SVKP, thinking it's something bad, or looking for a "clean" copy. SVKP is not infected, it is simply added to Nortons list of "hacker tools" because some script kiddies use the same protection on their viruses/trojans.
Trying to condense the best information here: http://www.renegadewiki.com/index.php?title=RenGuard_SVKP_Is sue
FYI, I have just sent this message to Symantec: Blazer I work for a nonprofit company that provides legacy support for a particular game title. One of our products is an anti-cheat addon, which utilizes the "SVKP Protector" to encrypt and protect our code from crackers. In effect, every game client (thousands) are using our module, which utilizes SVKP. The problem is that as of last week, Symantec added SVKP to their virus definitions as "Hacktool.Rootkit". This is causing *major* disruption of our customers who use Symantec security products, as their game clients no longer work, and we are being flooded with support issues as the average joe user just sees a popup that they are "infected" and want to know why our software is a virus or trojan. Please reply ASAP and let me know the procedure for requesting removal or alteration of a virus definition, or at least it's description page ( http://securityresponse.symantec.com/avcenter/venc/data/hack tool.rootkit.html), to include information to the effect of that just because a program is using SVKP, doesn't mean its a backdoor/trojan/rootkit. Our company pays a licensing fee to use SVKP, and Symantec has pretty much pulled the rug out from under us....please advise.
ok in an effort to smooth things over between clans... mostly under pressure from the clan to comply... I will make 1 civil post on this issue and then consider it dropped. My problem is not with your using the tool, its not taking action to eliminate the need for a tool that is being used by numerous worms and viruses out there to launch their attacks. AND telling people to just allow it to work ignoring the virus warning. New viruses are NOT caught in time by anti-virus companies all the time. So by white listing a blocked tool you put yourself at a higher risk then is recommended. Just to use your program. In my particular case I can not use it anyway, because I use windows 2000, but that's another issue. According to a message I received from AntiCracking@AntiCracking.sk the golden support customer base are able to receive an updated method for embedding their protection into their compiled executable. all you have to do is request a support ticket on the matter. This is a computer safety issue, not a renguard issue. according to symantec here http://securityresponse.symantec.com/avcenter/venc/data/w32. spybot.ubh.html the file "Creates the file %System%\SVKP.sys. This is used by the worm to unpack itself and execute" this is one of many worms currently using this method. Thats is why all of them are now adding it to their list of blocked signatures. Thus it is a vulnerability that should not be used if at all possible. the developers are aware of its current abuse and are taking stems to secure the method through other means. but at this time its a vulnerability, most. including myself, are not willing to risk using just for a 3rd party anti-cheating program. A similar problem is also hitting punkbuster, so there is no need to feel singled out. This is what they do. In any case. This is my last posting to your forums. I have no desire to continue the flame war between clans forums. I will instruct our members that upon a single complaint of continued flaming we will suspend them from HT clan for some predetermined period. I too will be suspended for a short time as a council member over this issue. This is an effort to repair any misgivings between clans and to end the PMs and flame posting... thank you, =HT=Ingram HazTeam Council.
Hey it worked!!! My only concern would be any other virus that uses this SVKP file? Thanks for your help, sure glad soe of you know whats up so we can continue to enjoy playing Renegade!!!! trashyall
Lol Blazer can't trust my svkp LOLOL. Ok w/e I hope you guys can fix your problems.
ingram091 wrote on Mon, 24 October 2005 06:52 My problem is not with your using the tool, its not taking action to eliminate the need for a tool that is being used by numerous worms and viruses out there to launch their attacks. AND telling people to just allow it to work ignoring the virus warning. Firstly, we cannot "eliminate the need for" the tool. If RG is not encrypted, there would be cracked copies of it out within 24 hours, and people would even be poking around it with a hex editor. And I would like to point out, that there has been no "virus warning". The alert the Symantec/Norton gives, if you actually take the time to read it, is that svkp.sys is not a virus itself, but rather may be part of or indication of another virus or trojan. To be honest, I have never heard or actually seen SVKP used for an actual virus, most script kiddies use UPX and other free exe wrappers. ingram091 wrote on Mon, 24 October 2005 06:52 New viruses are NOT caught in time by anti-virus companies all the time. So by white listing a blocked tool you put yourself at a higher risk then is recommended. Just to use your program. As I said, blacklisting SVKP is about as silly as blacklisting Visual C++, since afterall, they can both be used to create or part of a virus. If its possible, I would recommend some combination of settings such that svkp.sys is ignored, except if something tries to overwrite it. ingram091 wrote on Mon, 24 October 2005 06:52 According to a message I received from AntiCracking@AntiCracking.sk the golden support customer base are able to receive an updated method for embedding their protection into their compiled executable. all you have to do is request a support ticket on the matter. SVKP is a kernel mode ring-0 driver, and you cannot simply embed it into an executable. They do have lesser forms of protection that are not ring0 and can be embedded, but they can also be bypassed with ease, which is why we use the more elaborate solution. ingram091 wrote on Mon, 24 October 2005 06:52 This is a computer safety issue, not a renguard issue. according to symantec here http://securityresponse.symantec.com/avcenter/venc/data/w32. spybot.ubh.html the file "Creates the file %System%\SVKP.sys. This is used by the worm to unpack itself and execute" this is one of many worms currently using this method. Thats is why all of them are now adding it to their list of blocked signatures. That particular worm not only creates an SVKP.sys, it also exploits a bug in windows PNP (which has long since been fixed), and connects to an irc network. For to get infected by that worm, they would have to have a non-updated windows installation, the virus infection, and no firewall whatsoever (or at least one that wouldnt stop or popup on the outgoing irc connection). If they meet any of those criteria, I doubt blacklisting svkp will make them any more secure ingram091 wrote on Mon, 24 October 2005 06:52 Thus it is a vulnerability that should not be used if at all possible. the developers are aware of its current abuse and are taking stems to secure the method through other means. but at this time its a vulnerability, most. including myself, are not willing to risk using just for a 3rd party anti-cheating program. Until I hear of a significant number of cases where an actual virus uses SVKP, I would not be concerned at all about whitelisting SVKP.sys. The very URL you provided as "proof", shows that the number of reported infections were "0-49"...I bet it was a lot closer to 0 (like a single report), than it was to 49. Despite my views, I do recognize that it's your computer and you are entitled to be a paranoid as you want. Just know that we are very aware of the issue and are taking steps to do what we can, including considering a different protection software for RG 1.04, and accelerating the development of RG 1.04.
rc22fires wrote on Mon, 24 October 2005 07:39 Lol Blazer can't trust my svkp LOLOL. Ok w/e I hope you guys can fix your problems. Heh nothing personal, but mine was already posted and I know its clean, so no reason to have other unknown copies of it.
trashyall wrote on Mon, 24 October 2005 07:17 Hey it worked!!! My only concern would be any other virus that uses this SVKP file? Thanks for your help, sure glad soe of you know whats up so we can continue to enjoy playing Renegade!!!! There has been a very isolated report to Symantic of a virus that used SVKP.sys. For all we know it is the very incident that caused them to put SVKP.sys on their blacklist. The strange thing is it's not often that anti-v companies add a *file name* to their blacklist, usually the fingerprint specific virii and detect them that way. So, to answer your question, will blocking SVKP.sys stop any viruses that may use SVKP? Yes. But also consider, that SVKP itself is not a "hacker tool", or a virus, or a trojan. It is the kernel mode driver part of the SVK Protection software, so basically, just because you have an SVKP.sys, doesn't mean you have a virus. Think of it this way. Your car has blinking red lights to alert you of problems. So, does making sure there are no blinking red lights mean that your car is fine? Yes, but also just becauser there is a blinking light, doesn't mean it's something bad (alarm system?). So instead of making sure there are no blinking lights in your car, you consciously ignore the alarm system blinking light, because you know it's harmless. Same for SVKP.sys. If there was a real virus that used SVKP.sys, there would surely be other indications of it via either a direct fingerprint id by your antivirus, or your firewall, etc.
not sure how norton scans, but what about doing a ghetto fix, by renaming svpk.sys and starting that up as another service? Tell RG to look for that?
Blazer:So don't remove the svkp file.Okay what should I do to make rengaurd work on my machine.Still having problems trying to make rengaurd work thanks parker.
Nightma, that isn't a solution, in fact any one saying get a better antivirus is an idiot. People will uninstall RG over getting rid of Norton any day Personaly I would file a legal breif, send something directly to symantec threatning legal action against them if they don't resolve this issue.
Alkaline wrote on Tue, 25 October 2005 20:31 Nightma, that isn't a solution, in fact any one saying get a better antivirus is an idiot. People will uninstall RG over getting rid of Norton any day Personaly I would file a legal breif, send something directly to symantec threatning legal action against them if they don't resolve this issue. I quite agree. Unless Symantec can prove SVKP not only can... but does cause harm to your computer, they should refund BHS (and all other of SVKP's clients) money, plus damages, plus public relations costs, etc etc.
If you follow Kanezor's instructions at the bottom of page two in this post, Renguard will once again work!! Even if you can't remove the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY _SVKP. I was having the same problem w/Norton... I'm glad I read this though. I would add one more step though. Norton Antivirus has an "Auto Protect" feature. You must put the SVKP file under the exclusions list for this feature as well, or when you start renguard again, the auto protect will kick in, and you'll get that same message. Anyways, I'm glad Renguard is working again. I was in a game today, and it was 2vs1, and I was kickin some butt on hourglass, and they kept "!forcerg" me. I hate cheaters, and just because you're getting owned doesn't mean someone cheats... Thanx Kanezor!