Spyware is crashing World of Tanks: WargamingErrorMonitor.exe

Online multiplayer game videos and discussion
Santeri
Posts: 325
Joined: 2017-7-5 09:58

Unread post by Santeri » 2020-5-9 14:14

I found out the reason why World of Tanks Wargaming.net Game Center (WGC) messed up my computer. The reason is small piece of spyware that was introduced and forced with game center. The 3MB exe is calling actively home at https://cat.wargaming.net, trying forcefully start itself if killed or blocked, and bypassing firewall execution prevention like a typical malware. WGC does not even run without that spyware, but you can kill it from the game and run the game without WGC to get rid of it.

If you let it run freely, WargamingErrorMonitor.exe will be monitoring your computer, probably trying to find forbidden game mods, and sending your private information back to Wargaming without your consent and behind your back. The badly made exe kept crashing my game, sometimes up to 5-7 times per game, until I figured out how to remove it. Renaming this so called "error reporting tool" stopped crashes. Making your firewall block it is not enough, but if you make the exe inaccessible by renaming it, you will be able to play the game uninterrupted. In my installation the spyware is located at

Code: Select all

C:\Games\World_of_Tanks_EU\win64
I simply renamed in that directory file WargamingErrorMonitor.exe to WargamingErrorMonitor.exe.removed and it worked. You need to restore the spyware temporarily when you are forced to update the game to run WGC.

It is cleverly done so that it will delete all the reports after they are sent so that you have no way to check what was sent. Here is a capture of data what the spyware was trying to send:
{
    "data": {
        "cereal_class_version": 2,
        "event_config": {
            "event_type": "crash",
            "callstack_hash": 0,
            "crash_type": "unspecified",
            "assert_type": "",
            "post_event_policy": {
                "action": "notify_user_with_popup",
                "termination_exit_code": 1,
                "max_sequential_restart_count": 5,
                "sequential_restart_detection_threshold_seconds": 20
            },
            "dump": {
                "type": "minidump",
                "timeout_ms": 600000
            },
            "include_monitor_logs": true,
            "include_dx_diag": false,
            "files": [
                {
                    "caption": "DXDiag",
                    "directory": "C:\\Games\\World_of_Tanks_EU\\",
                    "filename_mask": "dxdiag\\.txt",
                    "recursive_lookup": false,
                    "restrictions": {
                        "max_files_count": 10,
                        "max_files_size_kb": 0,
                        "modified_less_than_days": 0
                    }
                },
                {
                    "caption": "GameLogs",
                    "directory": "C:\\Games\\World_of_Tanks_EU\\",
                    "filename_mask": ".*\\log",
                    "recursive_lookup": false,
                    "restrictions": {
                        "max_files_count": 10,
                        "max_files_size_kb": 0,
                        "modified_less_than_days": 0
                    }
                },
                {
                    "caption": "LastReplay",
                    "directory": "C:\\Games\\World_of_Tanks_EU\\replays\\",
                    "filename_mask": "temp\\.wotreplay",
                    "recursive_lookup": false,
                    "restrictions": {
                        "max_files_count": 10,
                        "max_files_size_kb": 0,
                        "modified_less_than_days": 0
                    }
                },
                {
                    "caption": "Preferences",
                    "directory": "C:\\Games\\World_of_Tanks_EU\\",
                    "filename_mask": "preferences\\.xml",
                    "recursive_lookup": false,
                    "restrictions": {
                        "max_files_count": 10,
                        "max_files_size_kb": 0,
                        "modified_less_than_days": 0
                    }
                },
                {
                    "caption": "PreferencesConsumer",
                    "directory": "C:\\Users\\name\\AppData\\Roaming\\Wargaming.net\\WorldOfTanks\\",
                    "filename_mask": "preferences\\.xml",
                    "recursive_lookup": false,
                    "restrictions": {
                        "max_files_count": 10,
                        "max_files_size_kb": 0,
                        "modified_less_than_days": 0
                    }
                },
                {
                    "caption": "Version",
                    "directory": "C:\\Games\\World_of_Tanks_EU\\",
                    "filename_mask": "version\\.xml",
                    "recursive_lookup": false,
                    "restrictions": {
                        "max_files_count": 10,
                        "max_files_size_kb": 0,
                        "modified_less_than_days": 0
                    }
                }
            ]
        },
        "report_guid": "9040_20-05-09-12_38_52_714",
        "client_hash": 7642345457010035658,
        "needs_composing": true,
        "event_info": {
            "type": "crash",
            "crash_type": "unhandled_exception",
            "code_of_exception": 3221225501,
            "assert_type": "",
            "callstack_hash": 1851,
            "thread_id": 4996,
            "process_id": 9040,
            "time": {
                "time_since_epoch": {
                    "count": 15890135327140000
                }
            },
            "process_duration": {
                "seconds": 323
            },
            "assert_expression": "",
            "assert_message": "",
            "assert_function": "",
            "assert_file": "",
            "assert_line": 0,
            "custom_data": "",
            "exception_name": "",
            "stack_trace": ""
        },
        "client_info": {
            "app_id": "wot_client",
            "app_version": "1.9.0.10034 #1351399",
            "long_descr": "WorldOfTanks",
            "client_executable": "C:\\Games\\World_of_Tanks_EU\\win64\\WorldOfTanks.exe",
            "restart_cmd": "",
            "custom_client_data": [
                {
                    "key": "is_vanila_version",
                    "value": "true"
                },
                {
                    "key": "current_space",
                    "value": "spaces/33_fjord"
                },
                {
                    "key": "version_build_id",
                    "value": "v.1.9.0.2 #307"
                },
                {
                    "key": "game_revision",
                    "value": "1355361"
                },
                {
                    "key": "overrides_revision",
                    "value": "1355576"
                },
                {
                    "key": "localization_revision",
                    "value": "1351235 RU"
                },
                {
                    "key": "branch",
                    "value": "v1.9"
                },
                {
                    "key": "AppName",
                    "value": "WorldOfTanks"
                }
            ],
            "build_commit_hash": ""
        },
        "server_connection": {
            "server_url": "https://cat.wargaming.net",
            "retry_count": 3,
            "retry_timeout_seconds": 5,
            "retry_cooldown_seconds": 3600
        },
        "monitor_logs_restrictions": {
            "max_files_count": 5,
            "max_files_size_kb": 0,
            "modified_less_than_days": 1
        },
        "upload_consent_rules_definition": {
            "report_archive_size_threshold_kb": 1024,
            "consent_dialog": {
                "content": {
                    "caption": "WorldOfTanks",
                    "header": "WorldOfTanks has stopped working",
                    "description": "Please, confirm sending error report ($report_size$) to the server for further analysis.\nIt will help us to fix the problem quicker.",
                    "helpLinkText": "",
                    "helpLinkUrl": ""
                },
                "yes_button_text": "&Upload",
                "no_button_text": "&Cancel",
                "default_button": "no",
                "auto_default_timeout_seconds": 30
            }
        },
        "working_directory": "C:\\Games\\World_of_Tanks_EU\\win64\\Reports",
        "available_artifacts": [
            {
                "label": "minidump",
                "file_list": [
                    "C:\\Games\\World_of_Tanks_EU\\win64\\Reports\\9040_20-05-09-12_38_52_714\\2020-05-09_12_38_52_769.dmp"
                ]
            }
        ],
        "archive_file": "",
        "cleanup_policy": {
            "max_age_seconds": 259200,
            "max_count": 0,
            "max_size_kb": 10485760
        },
        "session_id": "",
        "expiration_time": 0,
        "upload_unallowed": false,
        "working_set_bytes": 1622016000,
        "system_memory_status": {
            "total_ram_size_bytes": 17126047744,
            "free_ram_size_bytes": 12527386624,
            "page_file_size_bytes": 18199789568,
            "free_page_file_size_bytes": 8709566464
        },
        "storage_status": [
            {
                "drive_letter": "C",
                "free_bytes": 160170995712,
                "total_bytes": 244813131776
            }
        ],
        "client_process_cmd": "C:\\Games\\World_of_Tanks_EU\\win64\\WorldOfTanks.exe ",
        "recurring_events_config": {
            "timeout_threshold_ms": {
                "count": 2000
            },
            "register_on_server": true
        }
    }
}
An unencrypted dump attached to this error report would have provided a treasure trove for a malicious hacker to crack my computer. The error reporting tool provides also excellent means for attacking them using a spoofed error report. This was not the first time Wargaming is blatantly disregarding security.



AntiTanker

Unread post by AntiTanker » 2020-5-10 21:10

Thanks a million dude! Mine works again like a dream.

OLdMaN

Unread post by OLdMaN » 2020-5-11 13:05

Brilliant

Joe

Unread post by Joe » 2020-6-7 09:46

Thank you

WotCh
Posts: 1
Joined: 2020-6-21 04:07

Unread post by WotCh » 2020-6-22 13:42

Hi! Wargaming monitor this is anticheat. See https://wotcheats.ru/index.php?topic=265.0