GW.EXE Windows 7 Warning

LordDragon

Frost Gate Guardian

Join Date: Aug 2010

Dragons Den

E/

Suddenly got a Windows 7 Warning saying GW.EXE wanted to change some system files or some such. I told it NO and the game kept running and nothing seems to have changed.

VERY strange as I have never had Windows 7 warn me about the gw.exe file before.

No, I have NOT downloaded or run ANYTHING new between yesterday and today. No attachments in email and my browser has noscript running so it would be almost impossible for any rouge script on a web site to get me either.

Venganza

Wilds Pathfinder

Join Date: Feb 2011

Fire

When there is a game update, it is the EXECUTABLE which is changed, so any AV scanner worth it's salt will inform you of file change status, very simple and quite normal.

rhade_adama

rhade_adama

Ascalonian Squire

Join Date: Nov 2009

Ebonhawke, Blazeridge Mountains

The Forsaken Vampiric Vanguard [TFVV]

E/Mo

I get it all the time when there is an update for Guild Wars. The only thing I found is there is now a GW.001 file in my Guild Wars folder and I don't know what it is or where it came from. I've never heard of a .001 file before.

LordDragon

Frost Gate Guardian

Join Date: Aug 2010

Dragons Den

E/

Quote:
Originally Posted by Venganza View Post
When there is a game update, it is the EXECUTABLE which is changed, so any AV scanner worth it's salt will inform you of file change status, very simple and quite normal.
Well aware of that. This is the UAC on Windows 7 and the warning was that GW.EXE wanted to change system files. It was not a warning that GW.EXE had changed. I understand that one quite well.

The UAC pop-up was asking me if I wanted to allow GW.EXE to make changes to my system. Now, everything is most likely just fine as I have everything scanned on execute and have quite a bit of faith in my AV software (Sophos). It was just VERY out of character to get that warning in the middle of playing. I did not get the warning when I started the exe which one would think would be the case.

I was in the middle of a VQ and POP! up comes the GW.EXE UAC Warning.

Pinkest One

Lion's Arch Merchant

Join Date: Jan 2009

Ohio

Amateur Pwnography [SeKz] Officer

Mo/

I think the real question is "Why do you still have UAC on?"

Disable UAC>yes>Are you sure you want to disable UAC>...yes.

LordDragon

Frost Gate Guardian

Join Date: Aug 2010

Dragons Den

E/

No wonder so many peoples systems get infected and compromised.

Never mind, I'll go back through my logs and look at the packets of any network requests. Yes, I keep such logs. No, I am not going into why.

Quaker

Quaker

Hell's Protector

Join Date: Aug 2005

Canada

Brothers Disgruntled

Even I would not recommend turning off UAC on Windows 7 - or even Vista since the updates.
This is a curious situation though. It would be nice to know if it was just a normal gw.exe event connected to permissions, or if your gw.exe is corrupted by a virus.
That warning does not necessarily mean that gw.exe wanted to modify your 'system files', just your 'system', which could be something as simple as creating a new folder.

I would assume that you have, or will, do a virus/adware scan.

LordDragon

Frost Gate Guardian

Join Date: Aug 2010

Dragons Den

E/

Quote:
Originally Posted by Quaker View Post
Even I would not recommend turning off UAC on Windows 7 - or even Vista since the updates.
This is a curious situation though. It would be nice to know if it was just a normal gw.exe event connected to permissions, or if your gw.exe is corrupted by a virus.
That warning does not necessarily mean that gw.exe wanted to modify your 'system files', just your 'system', which could be something as simple as creating a new folder.

I would assume that you have, or will, do a virus/adware scan.
Yep, done a complete scan both with Sophos and with Trendmicro-online and nothing aside from a few cookies shows up. When I check my logs nothing was going in or out at that time except Guild Wars. Nothing was trying to get anywhere in an hour in each direction other than going to the GW server and other known places (Microsoft IP, Sophos IP, etc.) Neither did the GW.EXE exhibit any unusual behavior at the time of the UAC popup according to the logs.

I am not too worried about the exe being infected after checking everything I can. I just find it exceedingly strange for the UAC to pop up at that time on that program. I really cannot find any reason for it to act that way which is why I posted. Just seemed, well, strange.

End

End

Forge Runner

Join Date: Jan 2008

Rubbing Potassium on water fountains.

LF guild that teaches MTSC (did it long ago before gw2 came out and I quit...but I barely remember)

N/A

It may have been a warning about it wanting to create a file called gw.tmpwhich would be created in program files which would be protected in windows 7...


just a possibility.

Quaker

Quaker

Hell's Protector

Join Date: Aug 2005

Canada

Brothers Disgruntled

Quote:
Originally Posted by LordDragon View Post
I really cannot find any reason for it to act that way which is why I posted. Just seemed, well, strange.
Well, since GW dynamically downloads stuff in the background while you play, it may have involved some background update. Since the scans are ok, I'd let it do it if it asks again. It's also possible that UAC was triggered by a glitch or combination of events and gw.exe went ahead and did whatever it was anyway.

Draca

Draca

Academy Page

Join Date: Apr 2011

Sweden

E/

Let me guess you have guild wars installed in program files folder?

That count as changing system files for UAC.

LordDragon

Frost Gate Guardian

Join Date: Aug 2010

Dragons Den

E/

Quote:
Originally Posted by Draca View Post
Let me guess you have guild wars installed in program files folder?

That count as changing system files for UAC.
Actually, No. All my games get installed elsewhere.

Draca

Draca

Academy Page

Join Date: Apr 2011

Sweden

E/

Quote:
Originally Posted by LordDragon View Post
Actually, No. All my games get installed elsewhere.
Hmm i know newly formatted drives end up with Users having read access only. So if that is the case with this drive UAC would also trigger since admin access is needed to change files on the drive.