Hanako Games

PDM RootShell?

#1 by Glazunov - Jul 1 2011

Hi! I purchased the game last evening, and downloaded it from here: version 1.09. I'm running Kaspersky Internet Security, and whenever I start Magical Diary, I get a "proactive defense" warning of a PDMRootShell attack--meaning that the game is trying to redirect input/output. Kaspersky suggests this is the behavior of viruses that attempt to take control of computers.

I'm not the nervous type, so I strongly suspect this is just Kaspersky misinterpreting actions taken by the app at the start of the game. Still, I thought it worth mentioning (sites *do* get attacked now and again), as this particular message hasn't ever appeared in any other game or non-game app I've run. I've gotten plenty of messages about keyloggers--which you'd pretty much expect, since reinterpreting key actions is standard for games, but never a rootshell attack.

Somehow, I can't see Hanako games creating an army of bots to take over the world.

#2 by Spiky Caterpillar - Jul 1 2011

Hm. I think that it's a false positive - IIRC, Ren'Py (the engine Magical Diary is written in) redirects input/output to help log crashes, and the installer on our webserver doesn't seem to have been changed.

Do any other Ren'Py games also get detected as PDMRootShell? Magical Diary uses a slightly customized version of the engine, so other games not triggering the same message isn't necessarily a reason to worry - but is something I'll need to look into more.



Hanako edit: Cleaning up this thread; this conversation is getting technical and needs to go to PM/email.

#3 by Hiruo - Jul 1 2011

I didn't get any alarm, but I do not have the right installer size. Could this be because I downloaded the installer before 1.09 was out? Or should I worry?

#4 by Spiky Caterpillar - Jul 1 2011

If you downloaded before 1.09, yes, the installer size will normally be different. As will all the hashes.

I'm reasonably sure that this is a false positive, just trying to get the hashes to see if anything's been editing files in transit.

#5 by hanako - Jul 1 2011

Removing the technical stuff from the thread for now to avoid confusing people. Spiky likes to be very certain that nothing incredibly obscure is going wrong.

If any problem is found we'll update you.

#6 by Glazunov - Jul 1 2011

Spiky Caterpillar:

Do any other Ren'Py games also get detected as PDMRootShell? Magical Diary uses a slightly customized version of the engine, so other games not triggering the same message isn't necessarily a reason to worry - but is something I'll need to look into more.

The only other Hanako game I've got is Cute Knight Kingdom, which I recall buying from a third party via Amazon a while back. It doesn't cause any issues like this.

I'll check out the hashes, but my wife and I are running around taking care of all sorts of things this weekend, so dedicated time is rather short at the moment.

#7 by hanako - Jul 2 2011

CKK isn't a RenPy game (it was made with a different engine) so that wouldn't help anyway.

Don't worry about it too much, there's probably nothing wrong. (Although if anyone else gets an error message like this, please do let us know!)

#8 by Silver_Fox - Jul 3 2011

I sometimes get this error, but not all the time - only when I try to open the Magical Diary when either two browsers are already open, or one browser and an e-mail client are open. With one browser open, no problem.
I have Kaspersky Antivirus 11. However I am not worried. I found this antivirus is a bit paranoid when it comes to installing/opening games.