ESRO Client really clean?

[ownedbydark]

Hi guys two of my friends complained that they may got problems due to playing esro with their online banking.
I checked the connections which is esro opening, because this was the only programm they installed the last days.
First of all is the sro_client already detected by different anti virus tools as trojan.
I checked which connections the sro_client.exe opens and interessting is its opening a http connection ( Port 80) to this ip Address:58.64.28.172.
The regular sro_client is not doing that as far as i know.
Maybe its just their item mal which is poping up ingame or what ever.
But maybe here is someone more experienced user who can give us a little more details about that,

thanks in advance and best regards
ownedbydark

[Kape7]

What client are you talking about? My client or the ones that the admin uploaded after I left?

[ownedbydark]

I dont know which one he downloaded but i guess its the same or did you upload any other Client than the client from sro.vn?

[Kape7]

When I left the team he uploaded another client with esro5 included on the launcher and the links to my capacity page removed, that client was 100mb bigger than my client. I dont know what he modified there, so is for make sure if you are using the client he uploaded or mines.

[zeteris]

Originally Posted by ownedbydark

Hi guys two of my friends complained that they may got problems due to playing esro with their online banking.
I checked the connections which is esro opening, because this was the only programm they installed the last days.
First of all is the sro_client already detected by different anti virus tools as trojan.
I checked which connections the sro_client.exe opens and interessting is its opening a http connection ( Port 80) to this ip Address:58.64.28.172.
The regular sro_client is not doing that as far as i know.
Maybe its just their item mal which is poping up ingame or what ever.
But maybe here is someone more experienced user who can give us a little more details about that,

thanks in advance and best regards
ownedbydark

It's one of thSro (BlackRogue) ip. I think GameGuard uses this connection.

[ownedbydark]

I tried to catch any packets sent to that ip during the silkroad client is opened but there wasnt any packet. But i just started catching them after i was already logged in.
The connection was all the time alive.
That gameguard is a possibilty, i also saw that then connection is opening after choosing the character and entering the game not on the log on screen
@Synx7 my client including the Server 5 and was downloaded from their page

[zeteris]

I really think that client or GameGuard connects to thSro. Cause the ip u gave is very ( very means VERY ) simmilar to thSro GatewayServer.

[Kape7]

I think that IP is the ones from the Crest server (the ones with the guild marks). As far as I know the admin is still using the official crest server.