.BAT files in Wowace Files?

Roxaz · 06/16/07, 6:54 AM

So i downloaded several addons from wowace files a week ago, including pitbull, quartz, gladiator etc. And when i look into the folder, there're .bat files(MS-DOS Batch File) named 'AddonName'lod, i.e Quartzlod, Pitbulllod etc. I was browsing the WoW forums when i came across an Illidan kill vid thread with a zip file attached to it, obviously its a keylogger =\.

Then i scroll down to see a post that says 'That right thar is a bunch of "addons" in a zip file, with a .exe file stealthily renamed as a .bat file.
I am going to go with Keylogger, and will report this post accordingly.'

Now i'm getting worried, i just got dc'ed for no reason earlier on and immediately changed my pw. I went to check the processes in task manager and realised its all the regular processes thats running. Not being paranoia but are those .bat files in those addons FROM wowace.com/files safe, or what exactly are they?

p.s yes >< i'm a newbie at computers.

• Chicken · 06/16/07, 6:57 AM

Those .bat files from WoWace are actually to make parts of some Addons Load on Demand. For example, let's say you don't care about the swing timer function Quartz has and have it disabled. If you haven't run the .bat file, it'll still load the swing timer; if you have run the .bat file it won't load the swing timer at all, resulting in a (minor) performance boost.

If you want to check whether it's a real .bat file, simply open it with Notepad; real .bat files will contain plain readable text, while a .exe disguised as .bat would contain unreadable gibberish.

Roxaz · 06/16/07, 7:08 AM

Thanks for the quick reply and clarification. But if there is really a .exe file disguised at a .bat file, will i be safe as long as i don't run/click on it?

Teez · 06/16/07, 7:45 AM

Yes, WoW mods can't call external applications. You'd actually have to start the app manually (or somehow otherwise get infected w/ an application that would run the file in question.) Opening the file with notepad poses no risk.

sp00n · 06/16/07, 8:24 AM

Moreover .exe files can't be disguised as .bat files if you have "Hide extensions for known file types" disabled. It will simply show as 'iamthefile.bat.exe'.

=> http://www.fileinfo.net/help/windows...xtensions.html

sulliwan · 06/16/07, 11:58 PM

Originally Posted by sp00n

Moreover .exe files can't be disguised as .bat files if you have "Hide extensions for known file types" disabled. It will simply show as 'iamthefile.bat.exe'.

=> http://www.fileinfo.net/help/windows...xtensions.html

Actually you can just rename iamthefile.exe to iamthefile.bat and Windows will execute it anyway.
However, since real .bat files are usually quite simple scripts, just open the file in notepad and see what's really in there and what it does.

sp00n · 06/17/07, 7:46 AM

Originally Posted by sulliwan

Actually you can just rename iamthefile.exe to iamthefile.bat and Windows will execute it anyway.

Just tested this, didn't work for me.

// Edit
OK, it works for some .exe with a gui, for others without it doesn't.

sulliwan · 06/17/07, 7:49 AM

Originally Posted by sp00n

Just tested this, didn't work for me.

// Edit
OK, it works for some .exe with a gui, for others without it doesn't.

Works for me. And it's pretty safe to assume that whichever .exe bad guys want you to see as .bat will work :P

Opioid · 06/17/07, 11:37 AM

.BAT files can't do much bad except call an .EXE, and WOW can't call .EXEs since the Cosmos fuckery of olden times. Everything is safe.

(In fact Warden explicitly flips out if you are calling some .EXE because it assumes you're cheating so you would have had to consent to installing a system emulator driver for that malicious .EXE to go under the radar, and you would have noticed such a thing)

Ragnor · 06/17/07, 6:03 PM

Just open the .bat file in notepad, you'll see all legit ace bat files simply "unpack" or copy the libraries and sub folders into the root addon directory to so it works as a proper unembedded load on demand.

Couple of other things:

1: Always run a virus checker, Avira Anti Vir Personal is currently the best freeware one at the moment imo.
2: Only download mods from major addon sites specifically: www.curse-gaming.com/wow/, http://ui.worldofwar.net, www.wowinterface.com
3: If you are downloading Ace2 mods directly from their svn repository (files.wowace.com etc) be aware they are beta mods and constantly being updated multiple times during the day and so on

ckknight · 06/17/07, 7:27 PM

The bat files are safe, they just move modules into the addons folder.

This aside, be careful of anything you run into. If you are unsure of something, just don't run it.

Caligula · 06/20/07, 12:15 PM

Originally Posted by Opioid

.BAT files can't do much bad except call an .EXE, and WOW can't call .EXEs since the Cosmos fuckery of olden times. Everything is safe.

Can you elaborate on the Cosmos thing? I understand why Warden doesn't allow EXE calls due to WoWglider, etc. but what was the deal with Cosmos?

Antiarc · 06/20/07, 12:58 PM

To reiterate what others have said, just open .BAT files in Notepad. If you can read them, then it's pretty obvious what they do, and it's not an exe. If it's gibberish, delete it.

• Shalas · 06/20/07, 12:58 PM

Originally Posted by Caligula

Can you elaborate on the Cosmos thing? I understand why Warden doesn't allow EXE calls due to WoWglider, etc. but what was the deal with Cosmos?

UI mods never could run external programs. Pretty much every pre-1.10 restriction was due to something Cosmos did, though. Back in beta, something like WoWGlider would be (almost) entirly implementable as an addon, and so naturally people did.