Proof that Blizz are Reading running processes upon startup

[spriggy666]

Hi Guys,

Just thought I would share something to you all. For the people who do not believe that Blizz are scanning for running processes on your machine please have a look at the pasted info below. This was found as soon as I started to run the WoW.exe


Sat 09 - 21:17:12 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\windows\system32\csrss.exe [892]
Sat 09 - 21:17:12 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\windows\system32\csrss.exe [892]
Sat 09 - 21:17:12 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\windows\system32\csrss.exe [892]
Sat 09 - 21:17:12 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\windows\system32\csrss.exe [892]
Sat 09 - 21:17:12 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\windows\system32\csrss.exe [892]
Sat 09 - 21:17:12 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\windows\system32\csrss.exe [892]
Sat 09 - 21:17:12 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\windows\system32\csrss.exe [892]
Sat 09 - 21:17:12 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\windows\system32\csrss.exe [892]
Sat 09 - 21:17:12 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\windows\system32\csrss.exe [892]
Sat 09 - 21:17:12 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\windows\system32\csrss.exe [892]
Sat 09 - 21:17:12 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\windows\system32\csrss.exe [892]
Sat 09 - 21:17:12 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\windows\system32\csrss.exe [892]
Sat 09 - 21:17:12 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\windows\system32\csrss.exe [892]
Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\tortoisesvn\bin\tsvncache.exe [2404]
Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\tortoisesvn\bin\tsvncache.exe [2404]
Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\tortoisesvn\bin\tsvncache.exe [2404]
Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\tortoisesvn\bin\tsvncache.exe [2404]
Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\tortoisesvn\bin\tsvncache.exe [2404]
Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\tortoisesvn\bin\tsvncache.exe [2404]
Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\tortoisesvn\bin\tsvncache.exe [2404]
Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\tortoisesvn\bin\tsvncache.exe [2404]
Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\tortoisesvn\bin\tsvncache.exe [2404]
Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\tortoisesvn\bin\tsvncache.exe [2404]
Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\tortoisesvn\bin\tsvncache.exe [2404]
Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\tortoisesvn\bin\tsvncache.exe [2404]
Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\tortoisesvn\bin\tsvncache.exe [2404]
Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\open***\bin\open***-gui-1.0.3.exe [2588]
Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\open***\bin\open***-gui-1.0.3.exe [2588]
Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\open***\bin\open***-gui-1.0.3.exe [2588]
Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\open***\bin\open***-gui-1.0.3.exe [2588]
Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\open***\bin\open***-gui-1.0.3.exe [2588]
Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\open***\bin\open***-gui-1.0.3.exe [2588]
Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\open***\bin\open***-gui-1.0.3.exe [2588]
Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\open***\bin\open***-gui-1.0.3.exe [2588]
Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\open***\bin\open***-gui-1.0.3.exe [2588]
Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\open***\bin\open***-gui-1.0.3.exe [2588]
Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\open***\bin\open***-gui-1.0.3.exe [2588]
Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\open***\bin\open***-gui-1.0.3.exe [2588]
Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\open***\bin\open***-gui-1.0.3.exe [2588]

 

[residualz]

Hi Guys,

Just thought I would share something to you all. For the people who do not believe that Blizz are scanning for running processes on your machine please have a look at the pasted info below. This was found as soon as I started to run the WoW.exe


Sat 09 - 21:17:12 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\windows\system32\csrss.exe [892]
Sat 09 - 21:17:12 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\windows\system32\csrss.exe [892]
Sat 09 - 21:17:12 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\windows\system32\csrss.exe [892]
Sat 09 - 21:17:12 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\windows\system32\csrss.exe [892]
Sat 09 - 21:17:12 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\windows\system32\csrss.exe [892]
Sat 09 - 21:17:12 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\windows\system32\csrss.exe [892]
Sat 09 - 21:17:12 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\windows\system32\csrss.exe [892]
Sat 09 - 21:17:12 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\windows\system32\csrss.exe [892]
Sat 09 - 21:17:12 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\windows\system32\csrss.exe [892]
Sat 09 - 21:17:12 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\windows\system32\csrss.exe [892]
Sat 09 - 21:17:12 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\windows\system32\csrss.exe [892]
Sat 09 - 21:17:12 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\windows\system32\csrss.exe [892]
Sat 09 - 21:17:12 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\windows\system32\csrss.exe [892]
Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\tortoisesvn\bin\tsvncache.exe [2404]
Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\tortoisesvn\bin\tsvncache.exe [2404]
Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\tortoisesvn\bin\tsvncache.exe [2404]
Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\tortoisesvn\bin\tsvncache.exe [2404]
Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\tortoisesvn\bin\tsvncache.exe [2404]
Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\tortoisesvn\bin\tsvncache.exe [2404]
Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\tortoisesvn\bin\tsvncache.exe [2404]
Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\tortoisesvn\bin\tsvncache.exe [2404]
Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\tortoisesvn\bin\tsvncache.exe [2404]
Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\tortoisesvn\bin\tsvncache.exe [2404]
Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\tortoisesvn\bin\tsvncache.exe [2404]
Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\tortoisesvn\bin\tsvncache.exe [2404]
Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\tortoisesvn\bin\tsvncache.exe [2404]
Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\open***\bin\open***-gui-1.0.3.exe [2588]
Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\open***\bin\open***-gui-1.0.3.exe [2588]
Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\open***\bin\open***-gui-1.0.3.exe [2588]
Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\open***\bin\open***-gui-1.0.3.exe [2588]
Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\open***\bin\open***-gui-1.0.3.exe [2588]
Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\open***\bin\open***-gui-1.0.3.exe [2588]
Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\open***\bin\open***-gui-1.0.3.exe [2588]
Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\open***\bin\open***-gui-1.0.3.exe [2588]
Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\open***\bin\open***-gui-1.0.3.exe [2588]
Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\open***\bin\open***-gui-1.0.3.exe [2588]
Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\open***\bin\open***-gui-1.0.3.exe [2588]
Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\open***\bin\open***-gui-1.0.3.exe [2588]
Sat 09 - 21:17:13 [READ] c:\program files\world of warcraft\wow.exe [1944] was blocked from reading c:\program files\open***\bin\open***-gui-1.0.3.exe [2588]

What program blocked the reading?

 

[buzzerbeater]

And you think they dont already know this?

Just read this:

http://www.thebuddyforum.com/demonbuddy-forum/67048-db-security-improvements-2.html#post688015

Nothing more to say.

 

[Skaggy]

yeah i want to know too.
also why hasn't any devs caught up on this?
wouldn't blocking the read cause more suspicion?

 

[Armogeddon]

What is the name of the file you got this information from and is it one of the log files in the wow folder? You found this today, knowing the author(s) of HB are trying to fix bugs and get things working right with the new patch, yet you continue to use a program that doesn't work with WOW. You may be 100 percent right and it may be the fact that HB isn't working up to par with the new patch, yet.

 

[GIVEMEANAME]

whats that your running ?

 

[spriggy666]

What is the name of the file you got this information from and is it one of the log files in the wow folder? You found this today, knowing the author(s) of HB are trying to fix bugs and get things working right with the new patch, yet you continue to use a program that doesn't work with WOW. You may be 100 percent right and it may be the fact that HB isn't working up to par with the new patch, yet.

No its nothing to do with the wow folder. I am running an audit piece of software to run an audit on my other machine to see what is being called at certain times. I think that blizz are trying to push their luck reading running processes although they are not supposed to search outside of the wow client or the agent.exe

 

[Crakzor]

blizzard ur naughty

 

[qztr]

So? Rename it, profit. (Assuming it's working, it's working with DB anyway)

 

[Tiama]

Wow.exe is just looking for nvapi.dll in these directories. It's a shared dll and unfortunately tortoise is adding itself to the search path of the os and wow.exe is just reading directories from that path.


PATH=H:\Program Files\Common Files\Microsoft Shared\Windows Live;H:\Windows\syst
em32;H:\Windows;H:\Windows\System32\Wbem;H:\Windows\System32\WindowsPowerShell\v
1.0\;H:\Program Files\ATI Technologies\ATI.ACE\Core-Static;H:\Program Files\Tort
oiseSVN\bin;H:\Program Files\Windows Live\Shared

The same with open*** it adds itself to the PATH variable.

Delete them form the variable and wow won't try to access and read those pathes anymore.

 

[penis223]

So? Rename it, profit. (Assuming it's working, it's working with DB anyway)

what is DB?

 

[mboot]

Database

what is DB?

 

[penis223]

Database

Uhm. thanks.

 

[spriggy666]

haha, all you nitwits saying they are not allowed to do so for years...illegal and all that. Lmao!

one word to say now besides i told you so....!

gtfo!

Well its not illegal if you have accepted their terms and conditions as you are agreeing to them searching as of the new ToS. I just wanted to see what and how. Now I know, I think I might just hang up my old machine and just play normally unless someone somehow comes up with a way to run the bot over the network which a few people have already said that "It cant be done". Im sure that it can but I dont have the knowlege to know where to start on the project.

 

[Tiama]

haha, all you nitwits saying they are not allowed to do so for years...illegal and all that. Lmao!

one word to say now besides i told you so....!

gtfo!

You are dumb if you don't understand what wie wanted you to tell the whole time. Blizzard is only allowed to read the data that is necessary for Wow to run. If a program adds itself to a public variable than of course Blizzard can read that Information, but just not anything more.

 

[Pwn]

Well its not illegal if you have accepted their terms and conditions as you are agreeing to them searching as of the new ToS. I just wanted to see what and how. Now I know, I think I might just hang up my old machine and just play normally unless someone somehow comes up with a way to run the bot over the network which a few people have already said that "It cant be done". Im sure that it can but I dont have the knowlege to know where to start on the project.

So if it said in their ToS that "If you bot, we will send our assassins to kill you immediately", would that make it legal too? Use your brain.

 

[projektt]

Well its not illegal if you have accepted their terms and conditions as you are agreeing to them searching as of the new ToS. I just wanted to see what and how. Now I know, I think I might just hang up my old machine and just play normally unless someone somehow comes up with a way to run the bot over the network which a few people have already said that "It cant be done". Im sure that it can but I dont have the knowlege to know where to start on the project.

HAHAHAHAHAHHAHAHAHAHA This reminds me of that South Park episode where nobody would read Apple's ToS and then Apple was able to do whatever they wanted with them. Funny episode you should watch it.

 

[tmgplayer]

So.. do I need to do something, lol?


This does not seem like a good OP, and people chilled about the fact WOW can read whether or not we are running other programs.

 

[Shura123]

So explain this to me. If wow can read your process and find out you are botting, then why don't they just Mass ban those accounts?? the fact that we can still bot disagrees with the OP

 

[grig]

So explain this to me. If wow can read your process and find out you are botting, then why don't they just Mass ban those accounts?? the fact that we can still bot disagrees with the OP

It doesn't make sense from a business standpoint because it would cost them money. Instead of just mass banning every botter and scare us off to the point where we wouldn't make any new accounts, they just ban a few at a time. Also, it's more profitable for them to sue Bossland and get some cash from there too.