Anno 1503 King's edtion crashes

hereiam · Post by **hereiam** » Sat Sep 25, 2010 10:27 am

Hi there.

I use Ubuntu 9.10 with nvidia geforce 9400gt graphics card and the latest driver (185) of nvidia for this linux version is installed.

I tried to start the game but it crashed all the time.

Does anybody have an idea how I can fix that to play anno?

This is my error log:

Code: Select all


err:aspi:SCSI_OpenDevice Failed to open device /dev/sg1: Permission denied
fixme:ntdll:server_ioctl_file Unsupported ioctl 2d1400 (device=2d access=0 func=500 method=0)
wine: Unhandled page fault on write access to 0x00542000 at address 0x7bc4a93f (thread 001e), starting debugger...
Unhandled exception: page fault on write access to 0x00542000 in 32-bit code (0x7bc4a93f).
Register dump:
 CS:0023 SS:002b DS:002b ES:002b FS:0063 GS:006b
 EIP:7bc4a93f ESP:0053e630 EBP:0053e688 EFLAGS:00010246(  R- --  I  Z- -P- )
 EAX:0054b0d2 EBX:7bc9bff4 ECX:00000000 EDX:00000ffe
 ESI:00530000 EDI:00541000
Stack dump:
0x0053e630:  ffffffff 0053e664 0053e668 00000040
0x0053e640:  0053e718 00690066 0065006c 0000b000
0x0053e650:  00110053 00541000 0053e688 7b87087a
0x0053e660:  ffffffff 00541000 00001000 0ffe0040
0x0053e670:  0053e718 00000000 00000000 7ee8cff4
0x0053e680:  00541000 0054b000 0053e738 7ee8aa4e
Backtrace:
=>0 0x7bc4a93f LdrProcessRelocationBlock+0x9f() in ntdll (0x0053e688)
  1 0x7ee8aa4e in winedevice (+0xaa4d) (0x0053e738)
  2 0x7ee8ae13 in winedevice (+0xae12) (0x0053e9c8)
  3 0x7ee8b436 in winedevice (+0xb435) (0x0053ea18)
  4 0x7ee32e04 in advapi32 (+0x32e03) (0x0053ea68)
  5 0x7bc70b60 call_thread_func+0xb() in ntdll (0x0053ea78)
  6 0x7bc70d30 call_thread_entry_point+0x6f() in ntdll (0x0053eb48)
  7 0x7bc79495 in ntdll (+0x69494) (0x0053f398)
  8 0xf75e380e start_thread+0xbd() in libpthread.so.0 (0x0053f498)
  9 0xf7566b4e __clone+0x5d() in libc.so.6 (0x00000000)
0x7bc4a93f LdrProcessRelocationBlock+0x9f in ntdll: addl	%esi,0x0(%edi,%edx,1)
Modules:
Module	Address			Debug info	Name (28 modules)
PE	  540000-  54c000	Deferred        pfsvgae.sys
ELF	7b800000-7b972000	Deferred        kernel32<elf>
  \-PE	7b810000-7b972000	\               kernel32
ELF	7bc00000-7bcb8000	Export          ntdll<elf>
  \-PE	7bc10000-7bcb8000	\               ntdll
ELF	7bf00000-7bf04000	Deferred        <wine-loader>
ELF	7eca1000-7ecb9000	Deferred        hal<elf>
  \-PE	7ecb0000-7ecb9000	\               hal
ELF	7ecb9000-7ed3b000	Deferred        msvcrt<elf>
  \-PE	7ecd0000-7ed3b000	\               msvcrt
ELF	7ed3b000-7edaf000	Deferred        rpcrt4<elf>
  \-PE	7ed50000-7edaf000	\               rpcrt4
ELF	7edaf000-7edf4000	Deferred        ntoskrnl<elf>
  \-PE	7edc0000-7edf4000	\               ntoskrnl
ELF	7edf4000-7ee4f000	Export          advapi32<elf>
  \-PE	7ee00000-7ee4f000	\               advapi32
ELF	7ee4f000-7ee5b000	Deferred        libnss_files.so.2
ELF	7ee5b000-7ee66000	Deferred        libnss_nis.so.2
ELF	7ee66000-7ee6e000	Deferred        libnss_compat.so.2
ELF	7ee79000-7ee8e000	Export          winedevice<elf>
  \-PE	7ee80000-7ee8e000	\               winedevice
ELF	7efba000-7efe0000	Deferred        libm.so.6
ELF	7efe9000-7f000000	Deferred        libnsl.so.1
ELF	f7494000-f7498000	Deferred        libdl.so.2
ELF	f7498000-f75dd000	Export          libc.so.6
ELF	f75de000-f75f7000	Export          libpthread.so.0
ELF	f7617000-f7757000	Deferred        libwine.so.1
ELF	f7759000-f7777000	Deferred        ld-linux.so.2
Threads:
process  tid      prio (all id:s are in hex)
00000008 1503Startup.exe
	00000009    0
0000000e services.exe
	0000001d    0
	0000001c    0
	00000018    0
	00000015    0
	00000014    0
	00000010    0
	0000000f    0
00000011 winedevice.exe
	00000017    0
	00000016    0
	00000013    0
	00000012    0
00000019 (D) C:\windows\system32\winedevice.exe
	0000001e    0 <==
	0000001b    0
	0000001a    0
Backtrace:
=>0 0x7bc4a93f LdrProcessRelocationBlock+0x9f() in ntdll (0x0053e688)
  1 0x7ee8aa4e in winedevice (+0xaa4d) (0x0053e738)
  2 0x7ee8ae13 in winedevice (+0xae12) (0x0053e9c8)
  3 0x7ee8b436 in winedevice (+0xb435) (0x0053ea18)
  4 0x7ee32e04 in advapi32 (+0x32e03) (0x0053ea68)
  5 0x7bc70b60 call_thread_func+0xb() in ntdll (0x0053ea78)
  6 0x7bc70d30 call_thread_entry_point+0x6f() in ntdll (0x0053eb48)
  7 0x7bc79495 in ntdll (+0x69494) (0x0053f398)
  8 0xf75e380e start_thread+0xbd() in libpthread.so.0 (0x0053f498)
  9 0xf7566b4e __clone+0x5d() in libc.so.6 (0x00000000)

Post by **dimesio** » Sat Sep 25, 2010 11:17 am

hereiam wrote: I use Ubuntu 9.10 with nvidia geforce 9400gt graphics card and the latest driver (185) of nvidia for this linux version is installed.

That is not the latest nVidia driver, and the 185 drivers in particular had a bug that could be triggered by Wine. It was fixed in later versions of the driver; upgrade.

Post by **dimesio** » Sat Sep 25, 2010 3:18 pm

hereiam wrote:

Code: Select all

Modules:
Module	Address			Debug info	Name (28 modules)
PE	  540000-  54c000	Deferred        pfsvgae.sys

I didn't notice this earlier. Googling says pfsvgae.sys is a trojan. Delete ~/.wine and start over. It's probably a good idea to run a virus scan on any directories your user has write access to.

hereiam · Post by **hereiam** » Sat Sep 25, 2010 5:14 pm

which virus scanner can I use?

hereiam · Post by **hereiam** » Sat Sep 25, 2010 7:03 pm

I deleted the .wine directory. deinstalled wine and reinstalled it. scanned all directories but if I install spybot for example th trojaner horse still exists

DaVince · Post by **DaVince** » Sat Sep 25, 2010 7:26 pm

hereiam wrote:which virus scanner can I use?

Try ClamAV (and the ClamAV Nautilus extensions for easy scanning with it).

hereiam · Post by **hereiam** » Sat Sep 25, 2010 7:32 pm

will it it be any problem if I won't start wine any more?

So I think the trojaner will not be started. Could that be correct?

Post by **dimesio** » Sat Sep 25, 2010 9:14 pm

I deleted the .wine directory. deinstalled wine and reinstalled it. scanned all directories but if I install spybot for example th trojaner horse still exists

Where is it finding it, and why don't you just delete that file?

DaVince · Post by **DaVince** » Sun Sep 26, 2010 9:22 am

hereiam wrote:will it it be any problem if I won't start wine any more?

So I think the trojaner will not be started. Could that be correct?

Yeah, it probably wouldn't boot. Since removing the wineprefix didn't remove the trojan, perhaps you could just delete the directory where it finds this thing (while making sure all Wine apps are closed; use wineserver -k for that). Or try a different virus scanner, ClamAV works in Linux so it doesn't use Wine anyway.

hereiam · Post by **hereiam** » Mon Sep 27, 2010 11:24 am

ok, I scanned the wine directory etih the temp directory of my user in wine with clamav but virus was found. I installed the latest clamav version but if I start anno this file (pfsvgae.sys) is created in the temp directory.

Yesterday I installed a new version ob Ubuntu 10.04 so I removed all the data from the disk because I thought the trojan was located in the boot secotrs of the hdd. So i used the following command (dd if=/dev/zero of=/dev/sda).

Before I started clamav I killed the current wine server.

Maybe it is no trojan, I think.

hereiam · Post by **hereiam** » Mon Sep 27, 2010 11:42 am

Then I copied this file into a dumo virtual machine where windows xp is isntalled and scanned this file (pfsvgae.sys) with AntiVir and no trojan was found, too.

Post by **dimesio** » Mon Sep 27, 2010 12:31 pm

hereiam wrote:ok, I scanned the wine directory etih the temp directory of my user in wine with clamav but virus was found. I installed the latest clamav version but if I start anno this file (pfsvgae.sys) is created in the temp directory.

Yesterday I installed a new version ob Ubuntu 10.04 so I removed all the data from the disk because I thought the trojan was located in the boot secotrs of the hdd. So i used the following command (dd if=/dev/zero of=/dev/sda).

Before I started clamav I killed the current wine server.

Maybe it is no trojan, I think.

Or you're reinstalling it. Is your copy of the game legitimate? Are you using any no-cd cracks? What else are you installing in Wine?

As to whether it's really malware, I'm just going by the results from googling pfsvgae.sys.

DaVince · Post by **DaVince** » Mon Sep 27, 2010 1:13 pm

I thought the trojan was located in the boot secotrs of the hdd. So i used the following command (dd if=/dev/zero of=/dev/sda).

Not possible, unless you ran the trojan in Windows. Wine can't access the boot sector, and since the trojan itself is written for Windows it would never know how to get around any security issues in Linux (and it probably couldn't find the boot sector, anyway).

hereiam · Post by **hereiam** » Mon Sep 27, 2010 1:55 pm

dimesio wrote: Or you're reinstalling it. Is your copy of the game legitimate? Are you using any no-cd cracks? What else are you installing in Wine?

As to whether it's really malware, I'm just going by the results from googling pfsvgae.sys.

Yes I googled for this maleware, too. Ona german page I found that this file could be maleware if it is located in temp folder. So 54% of these files are maleware. I also scanned this file with antivir scanner and nothing was found. I also use original Anno1503 CD's without any crack other such other things.
No other programs and games are installed yet. It's really strange.

Anno 1503 King's edtion crashes

Anno 1503 King's edtion crashes

Re: Anno 1503 King's edtion crashes

Re: Anno 1503 King's edtion crashes