• Visit Rebornbuddy
  • Visit Panda Profiles
  • Visit LLamamMagic

    • Proof that Blizz are Reading running processes upon startup

    Discussion in 'Honorbuddy Forum' started by spriggy666, Mar 9, 2013.

    Page 1 of 2
    1. spriggy666

      spriggy666 New Member

      Joined:
      Jan 12, 2013
      Messages:
      31
      Likes Received:
      0
      Trophy Points:
      0
      Hi Guys,

      Just thought I would share something to you all. For the people who do not believe that Blizz are scanning for running processes on your machine please have a look at the pasted info below. This was found as soon as I started to run the WoW.exe


      Sat 09 - 21:17:12 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\windows\system32\csrss.exe [892]
      Sat 09 - 21:17:12 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\windows\system32\csrss.exe [892]
      Sat 09 - 21:17:12 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\windows\system32\csrss.exe [892]
      Sat 09 - 21:17:12 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\windows\system32\csrss.exe [892]
      Sat 09 - 21:17:12 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\windows\system32\csrss.exe [892]
      Sat 09 - 21:17:12 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\windows\system32\csrss.exe [892]
      Sat 09 - 21:17:12 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\windows\system32\csrss.exe [892]
      Sat 09 - 21:17:12 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\windows\system32\csrss.exe [892]
      Sat 09 - 21:17:12 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\windows\system32\csrss.exe [892]
      Sat 09 - 21:17:12 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\windows\system32\csrss.exe [892]
      Sat 09 - 21:17:12 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\windows\system32\csrss.exe [892]
      Sat 09 - 21:17:12 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\windows\system32\csrss.exe [892]
      Sat 09 - 21:17:12 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\windows\system32\csrss.exe [892]
      Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\tortoisesvn\bin\tsvncache.exe [2404]
      Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\tortoisesvn\bin\tsvncache.exe [2404]
      Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\tortoisesvn\bin\tsvncache.exe [2404]
      Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\tortoisesvn\bin\tsvncache.exe [2404]
      Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\tortoisesvn\bin\tsvncache.exe [2404]
      Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\tortoisesvn\bin\tsvncache.exe [2404]
      Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\tortoisesvn\bin\tsvncache.exe [2404]
      Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\tortoisesvn\bin\tsvncache.exe [2404]
      Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\tortoisesvn\bin\tsvncache.exe [2404]
      Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\tortoisesvn\bin\tsvncache.exe [2404]
      Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\tortoisesvn\bin\tsvncache.exe [2404]
      Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\tortoisesvn\bin\tsvncache.exe [2404]
      Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\tortoisesvn\bin\tsvncache.exe [2404]
      Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\open***\bin\open***-gui-1.0.3.exe [2588]
      Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\open***\bin\open***-gui-1.0.3.exe [2588]
      Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\open***\bin\open***-gui-1.0.3.exe [2588]
      Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\open***\bin\open***-gui-1.0.3.exe [2588]
      Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\open***\bin\open***-gui-1.0.3.exe [2588]
      Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\open***\bin\open***-gui-1.0.3.exe [2588]
      Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\open***\bin\open***-gui-1.0.3.exe [2588]
      Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\open***\bin\open***-gui-1.0.3.exe [2588]
      Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\open***\bin\open***-gui-1.0.3.exe [2588]
      Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\open***\bin\open***-gui-1.0.3.exe [2588]
      Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\open***\bin\open***-gui-1.0.3.exe [2588]
      Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\open***\bin\open***-gui-1.0.3.exe [2588]
      Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\open***\bin\open***-gui-1.0.3.exe [2588]
       
      spriggy666, Mar 9, 2013
      #1
    2. residualz

      residualz New Member

      Joined:
      Oct 30, 2012
      Messages:
      13
      Likes Received:
      0
      Trophy Points:
      0
      What program blocked the reading?
       
      residualz, Mar 9, 2013
      #2
    3. buzzerbeater

      buzzerbeater Well-Known Member

      Joined:
      Mar 21, 2011
      Messages:
      5,419
      Likes Received:
      28
      Trophy Points:
      48
      buzzerbeater, Mar 9, 2013
      #3
    4. Skaggy

      Skaggy New Member

      Joined:
      Oct 27, 2012
      Messages:
      308
      Likes Received:
      1
      Trophy Points:
      0
      yeah i want to know too.
      also why hasn't any devs caught up on this?
      wouldn't blocking the read cause more suspicion?
       
      Skaggy, Mar 9, 2013
      #4
    5. Armogeddon

      Armogeddon New Member

      Joined:
      Jan 1, 2013
      Messages:
      4
      Likes Received:
      0
      Trophy Points:
      0
      What is the name of the file you got this information from and is it one of the log files in the wow folder? You found this today, knowing the author(s) of HB are trying to fix bugs and get things working right with the new patch, yet you continue to use a program that doesn't work with WOW. You may be 100 percent right and it may be the fact that HB isn't working up to par with the new patch, yet.
       
      Last edited: Mar 9, 2013
      Armogeddon, Mar 9, 2013
      #5
    6. GIVEMEANAME

      GIVEMEANAME Active Member

      Joined:
      Dec 17, 2010
      Messages:
      1,533
      Likes Received:
      14
      Trophy Points:
      38
      whats that your running ?
       
      GIVEMEANAME, Mar 9, 2013
      #6
    7. spriggy666

      spriggy666 New Member

      Joined:
      Jan 12, 2013
      Messages:
      31
      Likes Received:
      0
      Trophy Points:
      0
      No its nothing to do with the wow folder. I am running an audit piece of software to run an audit on my other machine to see what is being called at certain times. I think that blizz are trying to push their luck reading running processes although they are not supposed to search outside of the wow client or the agent.exe
       
      spriggy666, Mar 9, 2013
      #7
    8. Crakzor

      Crakzor Member

      Joined:
      Dec 6, 2012
      Messages:
      94
      Likes Received:
      0
      Trophy Points:
      6
      blizzard ur naughty
       
      Crakzor, Mar 9, 2013
      #8
    9. qztr

      qztr Active Member

      Joined:
      Mar 31, 2012
      Messages:
      1,932
      Likes Received:
      17
      Trophy Points:
      38
      So? Rename it, profit. (Assuming it's working, it's working with DB anyway)
       
      qztr, Mar 9, 2013
      #9
    10. Tiama

      Tiama New Member

      Joined:
      Jul 20, 2011
      Messages:
      85
      Likes Received:
      0
      Trophy Points:
      0
      Wow.exe is just looking for nvapi.dll in these directories. It's a shared dll and unfortunately tortoise is adding itself to the search path of the os and wow.exe is just reading directories from that path.


      PATH=H:\Program Files\Common Files\Microsoft Shared\Windows Live;H:\Windows\syst
      em32;H:\Windows;H:\Windows\System32\Wbem;H:\Windows\System32\WindowsPowerShell\v
      1.0\;H:\Program Files\ATI Technologies\ATI.ACE\Core-Static;H:\Program Files\Tort
      oiseSVN\bin      ;H:\Program Files\Windows Live\Shared

      The same with open*** it adds itself to the PATH variable.

      Delete them form the variable and wow won't try to access and read those pathes anymore.
       
      Last edited: Mar 9, 2013
      Tiama, Mar 9, 2013
      #10
    11. penis223

      penis223 New Member

      Joined:
      Feb 20, 2013
      Messages:
      51
      Likes Received:
      0
      Trophy Points:
      0
      what is DB?
       
      penis223, Mar 9, 2013
      #11
    12. mboot

      mboot New Member

      Joined:
      Mar 3, 2012
      Messages:
      22
      Likes Received:
      0
      Trophy Points:
      0
      Database

       
      mboot, Mar 9, 2013
      #12
    13. penis223

      penis223 New Member

      Joined:
      Feb 20, 2013
      Messages:
      51
      Likes Received:
      0
      Trophy Points:
      0

      Uhm. thanks.
       
      penis223, Mar 9, 2013
      #13
    14. spriggy666

      spriggy666 New Member

      Joined:
      Jan 12, 2013
      Messages:
      31
      Likes Received:
      0
      Trophy Points:
      0
      Well its not illegal if you have accepted their terms and conditions as you are agreeing to them searching as of the new ToS. I just wanted to see what and how. Now I know, I think I might just hang up my old machine and just play normally unless someone somehow comes up with a way to run the bot over the network which a few people have already said that "It cant be done". Im sure that it can but I dont have the knowlege to know where to start on the project.
       
      spriggy666, Mar 9, 2013
      #14
    15. Tiama

      Tiama New Member

      Joined:
      Jul 20, 2011
      Messages:
      85
      Likes Received:
      0
      Trophy Points:
      0
      You are dumb if you don't understand what wie wanted you to tell the whole time. Blizzard is only allowed to read the data that is necessary for Wow to run. If a program adds itself to a public variable than of course Blizzard can read that Information, but just not anything more.
       
      Tiama, Mar 9, 2013
      #15
    16. Pwn

      Pwn Member

      Joined:
      Feb 10, 2012
      Messages:
      420
      Likes Received:
      6
      Trophy Points:
      18
      So if it said in their ToS that "If you bot, we will send our assassins to kill you immediately", would that make it legal too? Use your brain.
       
      Pwn, Mar 9, 2013
      #16
      Tiama likes this.
    17. projektt

      projektt Active Member

      Joined:
      Sep 21, 2010
      Messages:
      1,424
      Likes Received:
      8
      Trophy Points:
      38

      HAHAHAHAHAHHAHAHAHAHA This reminds me of that South Park episode where nobody would read Apple's ToS and then Apple was able to do whatever they wanted with them. Funny episode you should watch it.
       
      projektt, Mar 9, 2013
      #17
    18. tmgplayer

      tmgplayer New Member

      Joined:
      Feb 28, 2013
      Messages:
      35
      Likes Received:
      0
      Trophy Points:
      0
      So.. do I need to do something, lol?


      This does not seem like a good OP, and people chilled about the fact WOW can read whether or not we are running other programs.
       
      tmgplayer, Mar 9, 2013
      #18
    19. Shura123

      Shura123 New Member

      Joined:
      Dec 9, 2012
      Messages:
      53
      Likes Received:
      1
      Trophy Points:
      0
      So explain this to me. If wow can read your process and find out you are botting, then why don't they just Mass ban those accounts?? the fact that we can still bot disagrees with the OP
       
      Shura123, Mar 9, 2013
      #19
    20. grig

      grig New Member

      Joined:
      Dec 28, 2012
      Messages:
      120
      Likes Received:
      0
      Trophy Points:
      0
      It doesn't make sense from a business standpoint because it would cost them money. Instead of just mass banning every botter and scare us off to the point where we wouldn't make any new accounts, they just ban a few at a time. Also, it's more profitable for them to sue Bossland and get some cash from there too.
       
      grig, Mar 9, 2013
      #20
    Page 1 of 2

    Share This Page