Curse

LordDragon · Jul 02, 2011, 08:05 PM // 20:05

Suddenly got a Windows 7 Warning saying GW.EXE wanted to change some system files or some such. I told it NO and the game kept running and nothing seems to have changed.

VERY strange as I have never had Windows 7 warn me about the gw.exe file before.

No, I have NOT downloaded or run ANYTHING new between yesterday and today. No attachments in email and my browser has noscript running so it would be almost impossible for any rouge script on a web site to get me either.

Venganza · Jul 02, 2011, 08:57 PM // 20:57

When there is a game update, it is the EXECUTABLE which is changed, so any AV scanner worth it's salt will inform you of file change status, very simple and quite normal.

rhade_adama · Jul 02, 2011, 11:36 PM // 23:36

I get it all the time when there is an update for Guild Wars. The only thing I found is there is now a GW.001 file in my Guild Wars folder and I don't know what it is or where it came from. I've never heard of a .001 file before.

LordDragon · Jul 03, 2011, 12:22 AM // 00:22

Quote:

Originally Posted by Venganza

When there is a game update, it is the EXECUTABLE which is changed, so any AV scanner worth it's salt will inform you of file change status, very simple and quite normal.

Well aware of that. This is the UAC on Windows 7 and the warning was that GW.EXE wanted to change system files. It was not a warning that GW.EXE had changed. I understand that one quite well.

The UAC pop-up was asking me if I wanted to allow GW.EXE to make changes to my system. Now, everything is most likely just fine as I have everything scanned on execute and have quite a bit of faith in my AV software (Sophos). It was just VERY out of character to get that warning in the middle of playing. I did not get the warning when I started the exe which one would think would be the case.

I was in the middle of a VQ and POP! up comes the GW.EXE UAC Warning.

Pinkest One · Jul 03, 2011, 03:05 AM // 03:05

I think the real question is "Why do you still have UAC on?"

Disable UAC>yes>Are you sure you want to disable UAC>...yes.

LordDragon · Jul 03, 2011, 06:03 AM // 06:03

No wonder so many peoples systems get infected and compromised.

Never mind, I'll go back through my logs and look at the packets of any network requests. Yes, I keep such logs. No, I am not going into why.

Quaker · Jul 03, 2011, 02:04 PM // 14:04

Even I would not recommend turning off UAC on Windows 7 - or even Vista since the updates.
This is a curious situation though. It would be nice to know if it was just a normal gw.exe event connected to permissions, or if your gw.exe is corrupted by a virus.
That warning does not necessarily mean that gw.exe wanted to modify your 'system files', just your 'system', which could be something as simple as creating a new folder.

I would assume that you have, or will, do a virus/adware scan.

LordDragon · Jul 04, 2011, 04:30 AM // 04:30

Quote:

Originally Posted by Quaker

Even I would not recommend turning off UAC on Windows 7 - or even Vista since the updates.
This is a curious situation though. It would be nice to know if it was just a normal gw.exe event connected to permissions, or if your gw.exe is corrupted by a virus.
That warning does not necessarily mean that gw.exe wanted to modify your 'system files', just your 'system', which could be something as simple as creating a new folder.

I would assume that you have, or will, do a virus/adware scan.

Yep, done a complete scan both with Sophos and with Trendmicro-online and nothing aside from a few cookies shows up. When I check my logs nothing was going in or out at that time except Guild Wars. Nothing was trying to get anywhere in an hour in each direction other than going to the GW server and other known places (Microsoft IP, Sophos IP, etc.) Neither did the GW.EXE exhibit any unusual behavior at the time of the UAC popup according to the logs.

I am not too worried about the exe being infected after checking everything I can. I just find it exceedingly strange for the UAC to pop up at that time on that program. I really cannot find any reason for it to act that way which is why I posted. Just seemed, well, strange.

End · Jul 04, 2011, 05:07 AM // 05:07

It may have been a warning about it wanting to create a file called gw.tmpwhich would be created in program files which would be protected in windows 7...

just a possibility.

Quaker · Jul 04, 2011, 01:43 PM // 13:43

Quote:

Originally Posted by LordDragon

I really cannot find any reason for it to act that way which is why I posted. Just seemed, well, strange.

Well, since GW dynamically downloads stuff in the background while you play, it may have involved some background update. Since the scans are ok, I'd let it do it if it asks again. It's also possible that UAC was triggered by a glitch or combination of events and gw.exe went ahead and did whatever it was anyway.

Draca · Jul 04, 2011, 04:01 PM // 16:01

Let me guess you have guild wars installed in program files folder?

That count as changing system files for UAC.

LordDragon · Jul 04, 2011, 11:40 PM // 23:40

Quote:

Originally Posted by Draca

Let me guess you have guild wars installed in program files folder?

That count as changing system files for UAC.

Actually, No. All my games get installed elsewhere.

Draca · Jul 05, 2011, 07:06 AM // 07:06

Quote:

Originally Posted by LordDragon

Actually, No. All my games get installed elsewhere.

Hmm i know newly formatted drives end up with Users having read access only. So if that is the case with this drive UAC would also trigger since admin access is needed to change files on the drive.