Battle Stats – Statistics players in action

[The Elements Of Life]

Update V 2.18

Quote

- demo id from backup
- significantly accelerated data acquisition with WG API
- fixed bugs found
- refactoring part of the code, optimization

 

[Anonymous]

[Predseda3D]

Hi, why is version 2.1.8 creating cef_browser_process.exe file in /res/cef/ directory. And trying to access xml.explorads.com on port 50006?

Something big wrong with that.  

[A_Troll]

19 hours ago, Predseda3D said:

Hi, why is version 2.1.8 creating cef_browser_process.exe file in /res/cef/ directory. And trying to access xml.explorads.com on port 50006?

Something big wrong with that.  

You have adware on your PC.

F-Secure online scanner

Probably came from a mod site that is not this one.

 

[Hunter1]

3 hours ago, A_Troll said:

You have adware on your PC.

F-Secure online scanner

Probably came from a mod site that is not this one. 

 

I have the same file on mine Troll , it’s a new one from wargaming , ” World Of Tanks Chromium Embedded Browser ” and I know I could only get it from update.

[Predseda3D]

Hi, i was wrong. That browser exe file is from WG.

But this mod is trying to connect to really bad sites and IPs. If i remove this mod from WoT, everything is OK.  And it started with version 2 1 8

And yes, i am clean. I scanned my PC with malwarebytes, F-secure and all is OK.

[A_Troll]

I’m curious. How do you know where it is trying to connect? Do you have a screenshot?

What mods are you using? (Full list please I need as much info as I can to recreate it and see what is happening).

On 6/14/2018 at 6:11 PM, Wildest1 said:

I have the same file on mine Troll , it’s a new one from wargaming , ” World Of Tanks Chromium Embedded Browser ” and I know I could only get it from update.

I thiught some adware was hooking onto the browser extention. I’ve seen this before and it was something not related to the program the extension was embedded in. I’m not sure how it did it, because it suddenly stopped. I thought it was a glitch at the time.

I’m not saying this is the case now, but I would really like to re-create it if I can.

[andreamodding]

i deactivated malwarebytes to see what was happening. i got the ingame browser poping up almost after every battle and loading a betting website.:P with malwarebytes on i was notified that something was happening but the software was blocking it all the time

 

 

[A_Troll]

2 hours ago, andreamodding said:

i deactivated malwarebytes to see what was happening. i got the ingame browser poping up almost after every battle and loading a betting website.:P with malwarebytes on i was notified that something was happening but the software was blocking it all the time

 

 

Awesome. Can you find the adress it points you to anywhere else on your PC? (Registry keys too if you know how).

[andreamodding]

i will get back home on sunday it’s in the malwarebytes reports  for sure

 

[A_Troll]

I was wondering if you can search the PC for the adress signature in another folder/file/register entry. I wanna know where it came from because it doesn’t do that on my client.

[A_Troll]

What I do know is this….

Polyacov_Yury mods: radial menu, ut announcer, tank lights, colored chat kill msgs, camo selector.

One or all of those stuck something into the game (or register) that used that process.

Maybe somebody else figured out how to do that too?

It does not do that in my client but I only use BW mods. I use f-sec and got no messages. Nothing happens if I turn it off either.

Anybody want to share what mods they use (or have used) before they found this?

(Need I say I do not trust AVG).

[A_Troll]

Here ya all go. Thanks to Apollo for putting the last puzzle pieces in place for me.

The AVG flags DO NOT come from mods. They are not intentional from WG either. It’s all down to how the plugins work and useless data they collect.

This is what I think is happening.

1. The cef_browser_process.exe is simply communicating with Google analytics without acctually displaying anything.

2. Every address Google Analytics sends (suggests) is saved in a cookie file here……

                         C:Users***Your Name***AppDataRoamingWargaming.netWorldOfTanksprofilecef_cache

3. AVG captures the cookie file being saved because the cookie name contains a spam address.

4. AVG reports cef_browser_process.exe is trying to connect to….. blablabla……. when in fact it is just saving data to a cookie file. My f-sec does not look at it as a communication to internet so it does not flag it.

If I am wrong…. please feel free to call me an idiot. I cannot see bit-mining, trojans, malware or anything happening. It’s just addresses being saved that CONTAIN spam triggers. Someone mentioned acctually getting pop-ups but I REALLY can’t get that to happen.

[Predseda3D]

My MODS are:

1) YasenKrassen from http://forum.worldoftanks.eu/index.php?/topic/583433-1021-yasenkrasen-colored-messages-session-statistics-eng-21062018/

2) MarksOnGunExtended from https://github.com/spoter/spoter-mods/tree/master/mod_marksOnGunExtended

3) This mod StatsInBattle from here.

My Malware is blocking each time i come back from battle –

 

This is from this mod because i tried it without YasenKrasse and MoEExtended mods.

It is not about cookies, cache and files scaning. It is real-time connection.

 

Maybe site from which this mod is loading stats is hacked? I does not know just thinking.

[Predseda3D]

New “bad” site for today: “syndication.exdynsrv.com” 

 

After each battle this pop-up. I dont wanna disable my Malwarebytes but i think that it will open in-game browser with some site.

 

EDIT1: another new site 

 

[Author]

Posts