PnkBstrk.sys triggers Bitdefender alert

**Muqtar SGT_Clintok** · 03-12-08, 10:23 PM

Last night I received the bubble for updated needed on Vista64 (the little yellow shield in the lower left hand corner)

I dont remember even seeing this shield in vista, it has always just applied the updates automatically. This time I had to click on the appy updates and shut down. The updates all show up inside Windows update applet in Windows.

Tonight when I fired up BF2, Bitdefender detected Trojan.Peed.Gen inside PnkBstrk.sys.

The question is, have you all ever experienced antivirus software calling out punkbuster as infected?

I am slightly concerned.

**rv2pc3d** · 03-12-08, 11:07 PM

I was not aware of a pnkbstrk.sys running on the system...? The Punkbuster files running I thought were pnkbstrA.exe and pnkbstrB.exe.... Don't have anymore information for you other than that, and sorry for my ignornace.

Nevermind.... I did find these files, one for each game.

**Muqtar SGT_Clintok** · 03-13-08, 07:24 AM

I ran a deep scan over night and it said it found one infected file.I am wondering whether an update to either windows or bitdefender has caused the system to become concerned about a file that is a legit item. Punkbuster's whole concept doesn't seem to far from malware.

I will run it again and if it comes back up I will reimage the machine.

I never took the effort to create an image of the finished OS and application config.

This might be a good excuse to get in that position.

We troubleshoot for 60 minutes, then we reimage.

**WileECyte** · 03-13-08, 12:04 PM

PnkBstrk.sys is used by PBSVC.EXE when installing the Services to test the success of the installation. Normally it'll be found in C:\Windows or C:\Users\<Username> (Vista) or C:\Documents and Settings\<Username>.

I've not had anything pop up with either nod32 or AVG for the copy on my machine...

**darkfyrestorm** · 03-15-08, 02:00 AM

when i first got punkbuster on my machine...xp with spysweeper from webroot it kept quarenteening punkbuster b and k as malware but now that it has been on my comp for awhile it no longer comes up that way