Warning: PS Sistemas

[endomilik]

On July 7, I received an email about someone change my password on certain site..

https://i.imgur.com/PcEujXx.png

only 2 games I play Mu Online S15 Private Server and World of Warcraft.

Then I keep trying to dig. Open Cports to see active connection. Found out that the BP34QNK1.exe was Sending Packets.
https://i.imgur.com/nKY0smc.png

Then I went to Process location and turn out it was PS Sistemas.
https://i.imgur.com/OwftVam.png

Then I search video about this PS Sistemas Gameguard.

https://www.facebook.com/anticheat/v...75787127/?t=26

Turn out they can take a screenshot of your desktop and see what on your screen.

That Certain site happened to be on my desktop sticky notes and login info was also paste on that sticky notes..

I also deleted that BP34QNK1.exe but when I open MU again, it create another exe with different name.
When you block it with firewall, you cant connect to the game at all.

The PS Sistemas have illegal method viewing your screen and able to see what process you running.

[MentaL]

[Bola]

well, you have a name in their certify for signed code.

Source: Their own facebook.

[endomilik]

Even if its Digital Certified. But it is against to take a screen shot of your own desktop and upload it to them.

Let say im playing Mu Online that is running PS Sistemas. Used Mu Helper and Alt Tab to Browser and check email or buy stuff online.
What if your reading your email or typing your own credit card then suddenly the guy whos running PS Sistemas on their Mu Online press "Take a Screenshot". That would exposed your privacy to them.

PS Sistemas Function.
- Player search by HWID, IP or Character (MuOnline only).
- Screenshot of detection the moment the system sends the information to the server.
- Request a screenshot of the player screen whenever you want.
- System of exclusions of the basic protection, that allows to release certain software.
- Allows you to load external DLLs.


I ended up trying Anti-Screenshot tool.
Like SpyShelter, Zemana Anti-Logger, but it wont let the game launch perfectly..



EDIT: Screenwings works. Hopefully any MU Running PS Sistemas can enjoy that blackscreen.


Here an Example of server taking a screenshot of your desktop.. Picture jpg at 1080p Resolution usually at 1mb size. See the owner of this server is active around 3pm-10pm in my timezone GMT-5.. You can see the graph uploading at 1mb+ during those time line.. but when the owner goes to sleep, the upload seems normal.




For a Anti-Cheat that actually send packets higher than game itself, its fishy enough. Not even Battleeye,Nprotect, VAC. Does this.

[kinder32]

You can report that to microsoft, so the EV Certificated should be take down. Since there is no warning to the user who use this software.

[douglasruiz]

Many big companies like EasyAntiCheat and BattleEye use functions like that, the difference is, they show a dialog who notify player at first start and if he don't agree the game don't open. i'll add the same dialogue at PS on next update.

This function can be disabled at server side too if admin need that.

[Dope Boy One]

The PS Sistemas have illegal method viewing your screen and able to see what process you running.

well, you have a name in their certify for signed code.

I kinda like extra help on Mu Protection all the time, i kinda testing every anti-cheat system so far,
Mu is suffering from cheaters, it's an old game and all the bad stuff.. However, i think its good to have such a protection.. but is bad in "wrong" hands.

Besides that, nowdays many of the top games using even harder methods, threw kernel and you are most of the time exposed (on some high skilled hackers). I feel safe, when i know that i can prove a certain player is actually using hacks, by just showing a screenshot either if is automatic, or if i he is suspicious and i press the button, what a relief..

I think you need to be carefull, if the server you play is just a server, or if there is a real company behind.
Sometimes there is kids like 14-15 etc years old running a server, then for sure u are not protected.. but let me tell you something.. in any case, if the admin really want, he can try many methods to steal from you informations, dont forget "account informations", most of players already using same passwords on every device, email, accounts e.t.c they have.. Whos telling you that i can't just type on paypal or any other platform, all this emails and passwords, at the end i will find 2-3 workings for sure..

So, the problem is who's behind the server, not the antihack.. hopefully i am correct

[Mecanik]

@endomilik

Finally... people are starting to wake up. Good job mate on finding out that this software is running like a malware in your computer, hopefully others will take up too. I have been warning people for years, but nobody seems to listen to me and I am the "crazy" one...

You can report this kind of software (just google it) and make sure that nobody will be able to see what kind of porn you are watching, who are you talking to, your bank account, and anything else running opened on the screen.

I personally never run these kind of software on my PC, ever.
@douglasruiz

You are way out of your league, always been, always will be. Why ? Because you have no idea how EAC or BEA works, seriously. None of them take screenshots of your screen, it is illegal by design and there is no law that can allow you to do this. Antiviruses have this feature only when your device is stolen. You copying (I actually saw that days ago by mistake) BEA's message box is lame... only shows what kind of copy cats you all are, as always been. Regardless of this, please stop taking sensitive data from people's PC's because it won't stop anything.
@Dope Boy One

Seriously mate, I mean, are you even serious ? Do you think take taking screenshots of people's PC will "block" or "stop" anything ? Stop trying to find reasons to protect these people from showing the reality to players, and better yet, stop using systems that cause this damage to player's PC's... like UGK and his malware and bluescreen.

You know better from me what and where this industry is heading to, so why are you wasting time with them.

---

Seriously, it's time I stepped in again into this "market" and show people what a real anticheat should be again. Post coming soon.

[douglasruiz]

@endomilik

Finally... people are starting to wake up. Good job mate on finding out that this software is running like a malware in your computer, hopefully others will take up too. I have been warning people for years, but nobody seems to listen to me and I am the "crazy" one...

You can report this kind of software (just google it) and make sure that nobody will be able to see what kind of porn you are watching, who are you talking to, your bank account, and anything else running opened on the screen.

I personally never run these kind of software on my PC, ever.
@douglasruiz

You are way out of your league, always been, always will be. Why ? Because you have no idea how EAC or BEA works, seriously. None of them take screenshots of your screen, it is illegal by design and there is no law that can allow you to do this. Antiviruses have this feature only when your device is stolen. You copying (I actually saw that days ago by mistake) BEA's message box is lame... only shows what kind of copy cats you all are, as always been. Regardless of this, please stop taking sensitive data from people's PC's because it won't stop anything.
@Dope Boy One

Seriously mate, I mean, are you even serious ? Do you think take taking screenshots of people's PC will "block" or "stop" anything ? Stop trying to find reasons to protect these people from showing the reality to players, and better yet, stop using systems that cause this damage to player's PC's... like UGK and his malware and bluescreen.

You know better from me what and where this industry is heading to, so why are you wasting time with them.

---

Seriously, it's time I stepped in again into this "market" and show people what a real anticheat should be again. Post coming soon.

Said a lot and only said shit, especially those who started using leaked anticheat source at the beginning (MUEMU) .

[MeganZzZ]

@Mecanik Totally agreed, also let me put a bit more here:

• Everytime that the game is opened a random name of "PS GameGuard" process is created, total virus-worm activity, also when you close the game the random process name STILL OPENED, this is the reason why this shit can take screenshots all the time and everyone can steal your data (even with the GAME CLOSED!).

• Every Administrator can add a process name for detection, let say "explorer.exe", so this shit will take screenshots all the time (detecting Windows Explorer) and the result of this is totally dangerous, the proof is that you can see that the random process name steal a lot of bandwith of your internet.

• About protections:Driver: Protect "main.exe" and the random process name via ObRegisterCallbacks doesn't stop anybody to cheat, certain anti-virus softwares doesn't allow drivers to be loaded (even signed) and for Usermode: Injecting a DLL in every process and hooking via EAT/IAT/INLINE the following APIs:ZwOpenProcess, ZwWriteVirtualMemory, keybd_event, SendInput & mouse_event, doesn't stop anybody to cheat, there are a lot of differents APIs that can be used to have the same results (For example: PostMessageA for sending Keyboard or Mouse input).

• There are certain activity that we can't know what he is doing on every computer, there are a lot of CPU usage and a lot of bandwith internet usage, most of MU Online Anti-Hack doesn't do that, what REALLY is he doing?

But again, what we can expect from a brazilian kid that doesn't know a thing about coding and use things like "madexcept" ... i can't believe how he isn't banned from this forum.

EDIT: Lets everyone report to Microsft so his certificated goes down for malware activity.
https://www.microsoft.com/en-us/wdsi/filesubmission

[douglasruiz]

@Mecanik Totally agreed, also let me put a bit more here:

• Everytime that the game is opened a random name of "PS GameGuard" process is created, total virus-worm activity, also when you close the game the random process name STILL OPENED, this is the reason why this shit can take screenshots all the time and everyone can steal your data (even with the GAME CLOSED!).

• Every Administrator can add a process name for detection, let say "explorer.exe", so this shit will take screenshots all the time (detecting Windows Explorer) and the result of this is totally dangerous, the proof is that you can see that the random process name steal a lot of bandwith of your internet.

• About protections:Driver: Protect "main.exe" and the random process name via ObRegisterCallbacks doesn't stop anybody to cheat, certain anti-virus softwares doesn't allow drivers to be loaded (even signed) and for Usermode: Injecting a DLL in every process and hooking via EAT/IAT/INLINE the following APIs:ZwOpenProcess, ZwWriteVirtualMemory, keybd_event, SendInput & mouse_event, doesn't stop anybody to cheat, there are a lot of differents APIs that can be used to have the same results (For example: PostMessageA for sending Keyboard or Mouse input).

• There are certain activity that we can't know what he is doing on every computer, there are a lot of CPU usage and a lot of bandwith internet usage, most of MU Online Anti-Hack doesn't do that, what REALLY is he doing?

But again, what we can expect from a brazilian kid that doesn't know a thing about coding and use things like "madexcept" ... i can't believe how he isn't banned from this forum.

EDIT: Lets everyone report to Microsft so his certificated goes down for malware activity.
https://www.microsoft.com/en-us/wdsi/filesubmission

Mecanik is you? hahaha stop using fake accounts newb.
you already leaned how code? stopped using muemu based sources?

[MeganZzZ]

Mecanik is you? hahaha stop using fake accounts newb.
you already leaned how code? stopped using muemu based sources?

Lol? I'm not @Mecanik and if you have a problem with him, talk to him, also i can't believe that you still are around here kid, why you no stop desviating the main point and reply something decent on all you bad things that got exposed? Still waiting you ban stupid virus-seller from your Delphí trash ...

[douglasruiz]

Lol? I'm not @Mecanik and if you have a problem with him, talk to him, also i can't believe that you still are around here kid, why you no stop desviating the main point and reply something decent on all you bad things that got exposed? Still waiting you ban stupid virus-seller from your Delphí trash ...

You are so funny mecanik hahaha say i'm a kid but it's you who creates fake accounts for defame me :D

About answers okay let's go:

- Yes, Administrators can take screenshots when they need or see some player who they think are cheating.
- Otherwise PS only takes screenshot when detect something, and their resolution is "pf4bit" (Very low).
- PS send ticks every second to PS Server "heartbeat"
- About random names is for TGH cheats who modify the PS memory, but that already was removed and changed to a fixed name "PSGG.64.exe" at lasts builds.
- PS still running after game closes for 5 minutes and then close yourself for if players start game again don't need wait PS loads all again.
- CPU usage is from handle protection, and administrators can change the delay of all PS codes for it use less CPU or more CPU.

Virus seller? stop cry please :)
Delphi trash? maybe because you don't know code something better using delphi :D

If somebody have some doubt about how PS works just call me at skype suporte.psdev or contact me at my website and i'll answer all questions

[MeganZzZ]

You are so funny mecanik hahaha say i'm a kid but it's you who creates fake accounts for defame me :D

You still are a kid and i've said again that i'm not @Mecanik but if you can't understand it, what we can expect from you? ...

About answers okay let's go:

- Yes, Administrators can take screenshots when they need or see some player who they think are cheating.
- Otherwise PS only takes screenshot when detect something, and their resolution is "pf4bit" (Very low).

You are allowing to all Administrator to take a screenshot and any moment, when the game started, when someone adds "chrome.exe" to his detections and full screens are taked everytime, exactly like a spyware and no alerts o something appears on the desktop when the screenshot is taked, just violating the privacity like the thread's starter.

- PS send ticks every second to PS Server "heartbeat"

Oh, so every tick is of more than 200 kb? are you serious? (200 * 60 = 12000kbs) 12 mbs every minute?, "heartbeat" yeah sure ... what data are you stealing from people with it?

- About random names is for TGH cheats who modify the PS memory, but that already was removed and changed to a fixed name "PSGG.64.exe" at lasts builds.

Even with random name you are using a "PS Sistemas" folder that can be detected via GetModuleFileNameExA to identify the process name, but again, what we can expect from a Delphi kid?

- PS still running after game closes for 5 minutes and then close yourself for if players start game again don't need wait PS loads all again.

Again, the game is closed and the Administrator can steal eveything from the computer taking screenshots, even with MHP everytime that the game is closed and re-opened the player must wait, so you are allowing to everyone to steal information with your virus-trash.

- CPU usage is from handle protection, and administrators can change the delay of all PS codes for it use less CPU or more CPU.

This is totally fake, you are NOT showing anything that can proof this, also "handle" protection?, anyone can steal the handle from csrss or lsass with full access (PROCESS_ALL_ACCESS), keep liying kid.

Virus seller? stop cry please :)

Absolutely virus-seller, you are selling spyware that cause information stealing and high cpu usage that can cause a total damage on everyone CPU.

Delphi trash? maybe because you don't know code something better using delphi :D

Total Delphi trash from a kid ripper that uses anothers projects like "madhook".

If somebody have some doubt about how PS works just call me at skype suporte.psdev or contact me at my website and i'll answer all questions

Oh so you are desviating again to skype and you don't post anything about your exposed lies, still can't believe how you aren't banned from this place.

[Bola]

Absolutely virus-seller, you are selling spyware that cause information stealing and high cpu usage that can cause a total damage on everyone CPU.

Even if i disagree with Douglas about his anti cheat scanning methods, this sentence is totally bullshit, any cpu is ready for years of usage at maximum speed without causing any damage, most of time you're using your pc, it is gradually degrading naturally.

[MeganZzZ]

Even if i disagree with Douglas about his anti cheat scanning methods, this sentence is totally bullshit, any cpu is ready for years of usage at maximum speed without causing any damage, most of time you're using your pc, it is gradually degrading naturally.

No, because he doesn't put a fixed value (of kernel32.Sleep) and let the administrator to put a very low value to detection scans, and it can cause a LOT of CPU usage and the microproccesor can go to high temperature level and reduces his lifetime.
Also, we are talking about information stealing with massive screenshots, fake process detection (chrome.exe, firefox.exe, discord.exe, explorer.exe) to keep stealing data, we are talking of more sentences than just high CPU usage.