Support NeoGAF

[Tripon]

New thread for new news. Personally think it is important for Capcom to acknowledge how big of a fuck up they committed.

(Updated on 9/29/2016 6PM PDT)
We have new information regarding the update (Ver.1.09) for the PC that was distributed on 9/22.

After providing the update, we have received many inquiries, and after investigating the issue we have discovered that part of the data in the update contains a program with some security risks.

We have also confirmed that the quick-fix patch we distributed on 9/23 to address the issue PC users were having with launching the game, also fixes the security risk noted above.

We are asking users who did not update their game with the 9/23 quick-fix update, to update their game using the steps below:

If you have Street Fighter V running, please close the application.
Please keep the Steam Client running. The update for Street Fighter V should begin automatically.

Once the update is completed, close the Steam Client and restart your PC.
*The update won’t be applied until you restart your computer.

By performing the update using the steps listed above, you can remove the security risk, but we are also preparing a tool that will remove the unnecessary file from your system and we’ll provide this in the next few days.

http://store.steampowered.com/news/?appids=310950

Edit:
■Regarding Ver.1.09 of the PC version of Street Fighter V and the deletion tool (Updated on 9/30/2016 6:00PM PDT)

SEPTEMBER 30 - CAPCOM CUSTOMER SERVICE
As previously noted, we have discovered that the ‘Capcom.sys’ file included in the title update Ver. 1.09 of the PC version of Street Fighter V contains some security risks. We are now releasing a tool to delete the files with security issues at the following time.


9/30/2016 6:00PM (PDT)

＜Which users are affected by this issue＞
Users who have downloaded the title update Ver.1.09 on 9/22, but have not applied the additional patch that became available on 9/23, as well as users who had not restarted their PC after applying the additional patch.
After restarting your PC, the Capcom.sys file becomes invalid, and will not affect your systems. We apologize for the inconvenience, but please restart your PC.

After you have restarted your PC, please run the check/deletion tool listed below. This deletion tool will allow you to easily remove the Capcom.sys file, as well as search for any registry entries that are tied to the file, and delete them if discovered.

＜How to use the deletion tool＞
Close the Street Fighter V application.

Please keep the Steam client open. The Street Fighter V game update will begin automatically. Once the update is complete, you will notice 2 batch files have been added to the folder path below. (Please note that the location of the batch files may vary, depending on the users settings)

C:\Program Files (x86)\Steam\steamapps\common\StreetFighterV\Tools
→DeleteSFVdriver_ja.bat
→DeleteSFVdriver_en.bat

Right click on DeleteSFVdriver_en.bat, and select “Run as administrator."
If you double click on the tool to run it, the tool will not run.
DeleteSFVdriver_ja.bat is the same tool with Japanese instructions.

Follow the instruction prompts.

The tool will prompt you to restart your PC. Please restart your PC.

Once your PC has restarted, right click on the DeleteSFVdrive_en.bat and select “Run as administrator”.

Once the message “Capcom.sys or related registry doesn’t exist. End the program.” is displayed, the files have been deleted.

■ The reason for distributing as a bat file, and executing the file
We have decided to distribute the deletion tool as a bat file, so that users can see the source code and be assured that this file does not contain any harmful data. This also means that it would be very easy to manipulate the code to be used for malicious purposes. We ask that all users obtain and execute this file that they obtained through the Steam client. Obtaining this file through other sources can put you at risk of opening up your system to additional security risks. We ask that you do not download and execute files obtained by unknown sources.

We would like to again apologize for the inconvenience, and regret such situation has happened. Thank you for your continued support of Street Fighter V.

http://steamcommunity.com/games/310950/announcements/detail/834680518441056080?l=english

Edit: People already using capcom.sys to do shit. http://www.unknowncheats.me/forum/g...eversing/189625-capcom-sys-usage-example.html

 

[chaobreaker]

They're making it sound like they put the rootkit in accidentally? That doesn't sound right.

 

[Neoxon]

While it shouldn't have happened in the first place, at least they're owning up to it.

They better make damn sure that shit like this doesn't happen, again.

 

[Tripon]

They're making it sound like they put the rootkit in accidentally? That doesn't sound right.

The quality control at Capcom is not great.

Great forgiveness please.

 

[Hours Left]

A really dumb mistake, but at least they're addressing it. Most importantly, they're releasing a cleanup tool to remove the file for those affected by it.

 

[NinjaCoachZ]

It's good they're fixing it, but holy shit, how did it even get in there/not get spotted in the first place?

 

[RandomExpletive]

It's good they're fixing it, but holy shit, how did it even get in there/not get spotted in the first place?

I find it really hard to believe it "slipped in accidentally"

Unless we've got a rouge dev on our hands who told the higher-ups he could fix the zenny issue, and didn't tell anyone HOW.

 

[Tripon]

I find it really hard to believe it "slipped in accidentally"

Unless we've got a rouge dev on our hands who told the higher-ups he could fix the zenny issue, and didn't tell anyone HOW.

The code is known malware.

 

[Barkley's Justice]

Can someone provide context to us proles?

 

[Tripon]

Can someone provide context to us proles?

Capcom tried to upload a rootkit to the PC version of SFV to protect its microtransaction economy.

 

[1upsuper]

Wait, a SFV update came with malware?

 

[RandomExpletive]

The code is known malware.

Wasn't it modified malware to stop cheatengine? Or is it actually just straight up malware?

 

[Jaded Alyx]

I doubt 'capcom.sys' was an accident.

 

[theRizzle]

Unless we've got a rouge dev on our hands who told the higher-ups he could fix the zenny issue, and didn't tell anyone HOW.

He might even be purple or maroon!

 

[deadscreensky]

Capcom tried to upload a rootkit to the PC version of SFV to protect its microtransaction economy.

Important correction: they didn't try to upload a rootkit to all of their PC customers, they successfully deployed a rootkit to all of their PC customers.

It was obviously deliberate -- you can't re-purpose a well-known rootkit exploit accidentally -- and their suggestion of "discovery" here is just further insult. They probably feel the need to lie because their gross criminal behavior leaves them open to legal punishments, but hey, it's still a nonsensical garbage excuse.

 

[Heaven Shard]

What the hell? I capcom outsourcing these things to the cheapest source? Is this Capcom's idea of brute data-mining? What's going on?!

 

[NinjaCoachZ]

The code is known malware.

Important correction: they didn't try to upload a rootkit to all of their PC customers, they successfully deployed a rootkit to all of their PC customers.

It was obviously deliberate -- you can't re-purpose a well-known rootkit exploit accidentally -- and their suggestion of "discovery" here is just further insult. They probably feel the need to lie because their gross criminal behavior leaves them open to legal punishments, but hey, it's still a nonsensical garbage excuse.

But Capcom promised they would improve communication with their fanbase. Why would they lie to us??????

 

[ZeroCDR]

Capcom really shook my confidence in them with this garbage.

 

[GhostTrick]

Two things:
1. What risk for my computer ?
2. If there's a risk, do they plan a compensation ?

 

[Son Of Sparda]

I like how they are not even trying to act like they are sorry or regret what they did.

Yeah we "accidentally" released a malware called Capcom.sys but we guess it was a security risk? idk, doesn't look like a big deal but whatever. Here, now you can remove it if you don't like it.

This company, man.

 

[TheSeks]

They're making it sound like they put the rootkit in accidentally? That doesn't sound right.

Correct, it isn't. No matter what Capcom says, they intentionally did a rootkit with their "driver"/Capcom.sys in System32 to try to protect their microtransactions.

Also looking at that announcement, it doesn't seem like it auto-deletes the Capcom.sys file, which is what their hotfix DIDN'T do either, and why people had to tell folks that played post-patch to do it by checking.

gg Capcom, still not trusting.

Wait, a SFV update came with malware?

Yes, essentially.

 

[Vex_]

Im expecting lawsuits.

 

[CadetMahoney]

The words "accident" and "mistake" with non-apologies.

Would be very sad if there are no repercussions and it fades from memory.

 

[danmaku]

At Capcom, even damage control is clunky.

 

[Saoshyant]

They're making it sound like they put the rootkit in accidentally? That doesn't sound right.

If they acknowledged it wasn't an accident they could be taken to court and sued in a class action. They basically covered their bases by saying "it may have happened! we don't know how! but we fixed it, so we took responsibility by something we didn't cause intentionally, ok!?"

 

[Lucumo]

Meh, I hope someone sues them over this.

 

[SinCityAssassin]

Two things:
1. What risk for my computer ?
2. If there's a risk, do they plan a compensation ?

All the risk and no.

 

[Dunkley]

Wasn't it modified malware to stop cheatengine? Or is it actually just straight up malware?

It's hard to say, while Capcom.sys did disable stuff like DEP and thus could be considered malware by function, I wouldn't call it straight up malware since it doesn't aim to damage your computer, at least by itself, but rather opens up a backdoor for anything else to exploit.

 

[LurkerPrime]

I still can't believe Capcom did this. I'm going to do all I can to avoid buying their titles in the future. Ubisoft's always-online uPlay is one thing, but this a whole 'nother level of malevolence.

The most troubling thing is that Steam didn't catch it. I always thought they had some QA on their side to prevent malware from being distributed. It's the only thing that makes their "anyone can use Steam" mantra make sense.. or so I thought.

Two things:
1. What risk for my computer ?
2. If there's a risk, do they plan a compensation ?

1. As I understand it, expoiting Capcom's rootkit would allow anyone taking advantage of it to do anything. It subverted every. single. level. of security on a computer, by default, and by DESIGN.
2. lol

 

[Teknoman]

He might even be purple or maroon!

lol nice.

 

[fresquito]

Give me a bteak. They are making it sound like it slipped though their fingers and players are forgiving them because they are 'aknowledging' it? No wonder these companies keep doing all this bullshit when people are so easy to forgive and forget.

 

[rockyt]

They have to say it that way otherwise they would open themselves to legal action which they will lose since what happen was illegal.

 

[Ucchedavāda]

The code is known malware.

Source?

 

[El Sabroso]

By performing the update using the steps listed above, you can remove the security risk, but we are also preparing a tool that will remove the unnecessary file from your system and we’ll provide this in the next few days.

this sounds like they are not learning any lesson, and will fuck it up again, I think I'm gonna have to stay away from pc version once the next update arrives

 

[EdwardTivrusky]

Source?

There's a GAF thread with links from earlier this week that i'll try to find but here's a link to a story on The Register - "Double KO!"

Files and strings within them identify it as a well known malware.

 

[Kanann]

Class action lawsuit incoming.

 

[Ucchedavāda]

There's a GAF thread with links from earlier this week that i'll try to find but here's a link to a story on The Register - "Double KO!"

Files and strings within them identify it as a well known malware.

That article only describes the well documented fact that this is a root-kit. However, it does not link that piece of software with any "known malware". So what "known malware" are we talking about?

 

[MarcoZombieCannon]

this sounds like they are not learning any lesson, and will fuck it up again, I think I'm gonna have to stay away from pc version once the next update arrives

Of all the things to read into to think that (and believe me I feel it too), you choose that they said they're gonna release an uninstaller. Okay?

 

[rockyt]

The only thing that really needs to be understand is that it was a type of root kit code. People who jail break iphone or install root kit on their android phones know what a root kit can do. Root kit makes a back door to gain control and or change things around. This is really bad on PC since it is easy to identify who has this root kit by looking up people who play SFV on PC. If someone is knowledgable enough and the PC is on and connected online than that PC can be open to attack, identity theft, and any thing else hack related. Basically having the back door open with a welcome mat.

 

[Zomba13]

That article only describes the well documented fact that this is a root-kit. However, it does not link that piece of software with any "known malware". So what "known malware" are we talking about?

A quick google brings up the GAF thread where someone posted a link to this https://twitter.com/Bill307_ca/status/779492931799429120

FYI: Capcom.sys contains the string "Htsysm72FB" (obfuscated). If you search for "Htsysm" it is evidently a service used by malware.

 

[GhostTrick]

Does it get removed if I uninstall SFV ?

 

[MarcoZombieCannon]

Does it get removed if I uninstall SFV ?

No. You have to remove it yourself.

Besides, if you haven't launched the game since Urien came out you're fine anyway. It only installed the kit when launching the game.

And only if you launched the game on the day the patch came out.

And this.

 

[Melubas]

I uninstalled SF5 after the rootkit update but before the fix. Am I ok or do I need to reinstall it and let it download the latest update for the rootkit to be removed?

Edit: I didn't launch the game if that helps me.

 

[Moaradin]

No. You have to remove it yourself.

Besides, if you haven't launched the game since Urien came out you're fine anyway. It only installed the kit when launching the game.

And only if you launched the game on the day the patch came out.

 

[BocoDragon]

I'm not saying that everyone should understand the intricacies of computer security, but how could you work at a tech company and fail to have a single person raise the issue of the 2005 Sony music CD rootkit debacle?

I know it's been 11 years, but damn. It was a big deal.

It'd be like discovering that a game company hid an explicit sex mini game in their game code, being completely unaware of Hot Coffee.

Or are we at that point where people have forgotten that shit?

 

[daakusedo]

You had to launch the game after the steam update to get capcom.sys?

 

[gngf123]

Uninstalled the game the second the news broke and I have no intention of reinstalling it. Fuck Capcom for even trying it in the first place.

Does it get removed if I uninstall SFV ?

Nope, you need to do it manually.

 

[Ucchedavāda]

A quick google brings up the GAF thread where someone posted a link to this https://twitter.com/Bill307_ca/status/779492931799429120

Yeah, that seems to be the source of that claim, and it does not seem to be well researched. As far as I can tell, the only evidence that it is malware is that the string "Htsysm72FB" was obfuscated, but malware is far from the only software to make use of obfuscated strings (it could be serving as a digital watermark in this case). The rest of that persons claims simply appear to be wild speculation. The most I could find about the file itself was that one (out of several) malware checkers found it to be "suspicious", while tens of others gave it a pass.

There's also another game with that file on Steam, in the form of DLC for a now defunct (and hence unlisted) MMO:
https://steamdb.info/depot/106011/

I mean, it's bad enough that Capcom bundled that root-kit in the first place, so there is no reason to make up accusations to make it look worse.

 

[Refyref]

Yeah, that seems to be the source of that claim, and it does not seem to be well researched. As far as I can tell, the only evidence that it is malware is that the string "Htsysm72FB" was obfuscated, but malware is far from the only software to make use of obfuscated strings (it could be serving as a digital watermark in this case). The rest of that persons claims simply appear to be wild speculation. The most I could find about the file itself was that one (out of several) malware checkers found it to be "suspicious", while tens of others gave it a pass.

There's also another game with that file on Steam, in the form of DLC for a now defunct (and hence unlisted) MMO:
https://steamdb.info/depot/106011/

I mean, it's bad enough that Capcom bundled that root-kit in the first place, so there is no reason to make up accusations to make it look worse.

Rootkits are malware. The only question here is whether this malware was based on an existing one, or made from scratch.

 

[Cow Mengde]

Can someone explain what's a rootkit to me? I know it's malware and bad, but why is it bad? What does it do?