Launch Error: please close WinDivert before launching game (Rust/Scum)

[basil00]

This error has been reported by users attempting to launch the Rust or Scum games.

https://steamcommunity.com/app/252490/discussions/0/2590022385655120635/
https://steamcommunity.com/app/513710/discussions/0/2590022385660130241/
https://steamcommunity.com/app/513710/discussions/0/2590022385666192589/
https://www.reddit.com/r/SCUMgame/comments/9e6uu7/launch_error_please_close_windivert_before/
https://twitter.com/honziq17/status/1037773944684793858
https://www.youtube.com/watch?v=V0_3RE-n8zg

This presumably an attempt by the game devs to thwart cheating software? If so, this obviously has a lot of collateral damage, and will affect many other unrelated legitimate applications.

Besides, if Rust/Scum are vulnerable, they ought to encrypt their network traffic which most modern games already do. If cheating software is the issue, then they ought to target the software itself, and not a library used by the software which is also used by many other legitimate applications.

The error message please close WinDivert before launching game is not very helpful, since WinDivert is not an application. According to the reddit thread, issuing a stop command will allow the game to run:

• Open a Command Prompt as Administrator
• Issue the command sc stop WinDivert1.X where X is {1,2,3,4} (depending on which version is running).

[TechnikEmpire]

Ah, leave it to bad developers to give a good thing a bad name.

I guess this is going to create a requirement for users to fork, differentiate and resign themselves if people are going to start creating signatures of the current package to identify and terminate it like it's malware.

[basil00]

Btw, it would be helpful if somebody (with a steam account) could link/post this to the steam Rust/Scum community discussion forums. (I tried but need but an anonymous account does not work).

Ah, leave it to bad developers to give a good thing a bad name.

It does damage the project's reputation, which I am not happy about. There also also several followup forum posts that erroneously equate the project with malware, followed up by some very bad advice on how to remove it (usually involves running some third party program, and who knows what that does). Fortunately, the big AV companies correctly classify WinDivert.

I guess this is going to create a requirement for users to fork, differentiate and resign

Yes, that would be bad. WinDivert has been deliberately designed not to run in "stealth", since ultimately the user should have control over what they run.

[TechnikEmpire]

I posted some stuff on steam as requested.

[TechnikEmpire]

Oops, I totally glossed over the fact that it was two separate titles. I'll duplicate my posts to both game's forums

[TechnikEmpire]

Unfortunately the feedback in steam in bad, and I don't think some sort of PR campaigning is going to help. People are sick of being cheated in games, and they're angry, so they Google "WinDivert + cheat keyword", see results and hate on the project.

[basil00]

Unfortunately the feedback in steam in bad, and I don't think some sort of PR campaigning is going to help.

It was mainly to alert the devs, although the thread probably got buried. People also get defensive especially when confronted, but being on record that WinDivert is not malware is better than staying silent.

Nevertheless, this is a serious problem. The fact that some cheat software may use a software component does not justify blocking that component when it was designed for, and has, many legitimate uses. An analogy would be blocking all bittorrent protocol traffic because it may be used for copyright infringement.

"WinDivert + cheat keyword"

I need to investigate some more. It seems that, most likely, the problem is "lag switching". Here, the network is temporarily disabled by the cheater, and because of the way online games are designed, this usually translates into an advantage. Encryption does not help. I think there are also ways this can be implemented without WinDivert, such as local congestion.

Also, I think the game might be using a third party anti-cheat system (Easy Anti Cheat), and perhaps they are responsible for the problem.

[basil00]

I'll close this since it is not really a WinDivert issue per se.

[TechnikEmpire]

True I wasn't even thinking lag switch when I ranted.

[basil00]

Also, I think the game might be using a third party anti-cheat system (Easy Anti Cheat), and perhaps they are responsible for the problem.

This seems likely since other games (beyond Rust/Scum) are also affected.

"WinDivert + cheat keyword"

Also, googling for "WinDivert + X" will generate a lot of hits provided X is anything networking related.

[TechnikEmpire]

I emailed anti-cheat people to see if they're open to changing their method and offering to help.

If that doesn't work then I dunno this might become a real problem for residential targeted products relying on WinDivert.

[eac-skillet]

Hi from the Easy Anti-Cheat team and apologies for the delayed follow up on this.

WinDivert should now be unblocked in all of the games mentioned.

To clarify, the message users saw was not intended to mark WinDivert itself as a cheat since it certainly has legitimate uses, but rather as a driver used primarily for development/debugging that has also been extensively abused by cheats and exploits.

Preventing such drivers from running at the same time as the game is a compromise that often works fairly well. In this case however, the "primarily for development/debugging" part was clearly not quite accurate and that's where things went wrong.

Sorry for the trouble!

[TechnikEmpire]

Thanks for the quick response and thanks for making that change. :)

[basil00]

@eac-skillet Thanks for addressing this.

[SirLynix]

Hi from the Easy Anti-Cheat team and apologies for the delayed follow up on this.

WinDivert should now be unblocked in all of the games mentioned.

To clarify, the message users saw was not intended to mark WinDivert itself as a cheat since it certainly has legitimate uses, but rather as a driver used primarily for development/debugging that has also been extensively abused by cheats and exploits.

Preventing such drivers from running at the same time as the game is a compromise that often works fairly well. In this case however, the "primarily for development/debugging" part was clearly not quite accurate and that's where things went wrong.

Sorry for the trouble!

Really sorry to hijack this issue.

Hello @eac-skillet, I'm not sure you'll see this message but I have no other option to contact EAC devs.

I'm a developer using Clumsy (which uses WinDivert) to test my game networking.
I've been banned by EAC a few years ago because I left clumsy running while playing Dead by Daylight, I tried to appeal the ban but mostly got the answer "we have proof you cheated, bad luck" (should I mention I never cheated in any online game?)

I know it's clumsy because I bought EAC on another steam account which also got banned after leaving clumsy running. That account got unbanned and I couldn't start DbD with clumsy open after that.

Would it be possible to be unbanned (or maybe talk to another EAC dev about this)? (my steam id is 76561197971232514)

I know you must hear a lot of stories about cheaters saying they didn't cheat, and I'm sorry to bother you but I've been trying for years to unban this account (some people thing I'm a cheater because of the steam message on my profile, even though I never cheated in any way).

Thanks for reading