Warden TCK module timer and AKP timer delay for packet scans

[Skuddle]

CURRENT STATE: Unbannable

Your computer will treat this as a virus the moment you download it. Please note, I do not upload viruses, as well as everything before it can be run is able to be inspected using Notepad. The files are a .vbs, to prevent memory imprints, and to execute top down. These settings will apply a registry hack. This will not prevent warden from scanning you, however it will cause a bit of the packets not to work from warden.

Current Version:v1.21
Download link: http://go-guildies.com/mmowned/WPKv121.rar

Patch notes:
August 28-2010 v1.21
+Added remover
+Added checker
+Fixed Minor Installer bug
+Users can no longer escape Admin Login by doing a ./ command.

July 1 2010 v1.1
+Initial release





Boys and girls,

Enjoy. Adjusting the QoS of your packets as well as your relay packet grouping will disable the ability for Warden to scan your packets. This will protect your 0x05 base packet group from being scanned. IT DOES NOT PROTECT YOU FROM WARDEN, however its a good step towards preventing Warden from scanning you.

How it works:

Blizzard groups packet relays and responses together. Warden then scans them. Since this script will adjust your actions, when you get a packet you immediately fire a response before it routes through the current loaded Warden Module.

The downside?
You may experience some lag time some times. What happens is it sometimes fires your packet to fast and doesn't grab an encryption key on the way out because the module hasn't generated one for the next set of packets.

It will improve your LAT rate. You will show 100 if your at 200, and 90-150 if your at 340 usually. This is not your real latency. Its what warden is set to look for, however since your packets come at the same rate, its looking for the wrong thing.


SOURCE CODE:

logo = "Skuddle Packet Timer"
  WPK_Version = "1.02"
  Const HKEY_LOCAL_MACHINE = &H80000002
  Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\default:StdRegProv")
  Set shell = CreateObject("Shell.Application")
  set wsnet = WScript.CreateObject("WScript.Network")
  computername = ucase(wsnet.computername)
  strKeyPath = "SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\"
  oReg.EnumKey HKEY_LOCAL_MACHINE, strKeyPath, arrSubKeys
  if Wscript.Arguments.Count => 1 then
    if (WScript.Arguments.Item(0) = "uac") then WPK_Uac = 1 else WPK_Uac = 0
  end if
     If Instr(1, WScript.FullName, "cscript", vbTextCompare) > 1 Then
    WPK_Script = 1
  End If
  if WPK_Script = 1 and WPK_Uac = 0 then
    wscript.echo "Warden Packet Timer " & WPK_Version & " Batch Mode."
    wscript.echo ""
  end if
  if CheckFix = true then
    msg = "Warden Packet Timer already enabled"
    if WPK_Script = 0 then
      msg = msgbox (msg,48,logo)
    else
      wscript.echo msg
    end if
    wscript.quit
  end if
  If WPK_Uac = 0 then
    if WPK_Script = 0 then
      msg = logo & " " & WPK_Version & chr(13) & chr(13) & "This regedit will auto adjust the poll rate for your LAT timer and reduce the chances of Warden Scans on module based inclusions. It has been updated for 3.3.5a. You must have Windows XP SP2 or greater." _
                       & chr(13) & chr(13) & "If you are not logged into your computer with an account which has Administrator privileges, or you are using Windows Vista or Windows 7 with User Account Control enabled, you will be prompted to enter the username and password of an account which has Administrator privileges." _
                       & chr(13) & chr(13) & "Enjoy the protection. Skuddle of http://mmowned.com" _
                       & chr(13) & chr(13) & "Install"
    else
      msg = "Adjusting..."
    end if

    if WPK_Script = 0 then
      msg = msgbox (msg,65,logo)
        if msg = 2 then
          wscript.quit
        end if
    else
        wscript.echo msg
    end if  
  end if
  For Each subkey In arrSubKeys
    err = oReg.SetDwordValue (HKEY_LOCAL_MACHINE,strKeyPath & subkey,"TcpAckFrequency","1")
  Next
  if CheckFix = true then
    Success
    wscript.quit
  end if
  if CheckFix = false and WPK_Uac = 0 then
    if WPK_Script = 0 then
      msg = "You are not running this script as ADMIN. You must be an admin."
      msg = msg + chr(13) + chr(13) & "User Account Control forces programs to run under regular user privileges, even if you are logged into your computer with an account which has Administrator privileges.  It's enabled by default on computers running Windows Vista and Windows 7."
      msg = msg + chr(13) + chr(13) & "To get around this, you will be prompted to enter your Windows logon details.  In the next window, check the radio button for 'The following user' and enter the username and password of a Windows account which has Administrator privileges.  The username must be in the format '" & computername & "\username'."
      msg = msg + chr(13) + chr(13) & "Click Ok to continue"
      msg = msgbox (msg,49,logo)
    if msg = 2 then
      wscript.quit
    end if
    shell.ShellExecute "wscript.exe", Chr(34) & _
    WScript.ScriptFullName & Chr(34) & " uac", "", "runas", 1
  else
    wscript.echo "Logon failure.  You must be logged in with Administrator privileges."
    wscript.quit
  end if
  end if
  if WPK_Uac = 1 then
    if CheckFix = false then
      msg = "There was an error (" & err.number & ")." & chr(13) & chr(13) & "Ensure that you entered a valid username and password.  The username must have Administrator privileges on this computer." & chr(13) & chr(13) & "Click Ok to close the script."
        if WPK_Script = 0 then
          msg = msgbox (msg,48,logo)
        end if
    else
      Success
    end if
  end if
  wscript.quit
  Function CheckFix()
     StopCheck = 0
    For Each subkey In arrSubKeys
      oReg.GetDWORDValue HKEY_LOCAL_MACHINE,strKeyPath & subkey,"TcpAckFrequency",CheckFix
      if CheckFix = 1 then 
      else StopCheck = 1
      end if
    Next
    if StopCheck = 1 then CheckFix = false else CheckFix = true
  end function
  Function Success()
    if WPK_Script = 0 then
      set shell = wscript.CreateObject("wscript.shell")
      msg = "Warden Packet Timer has been installed successfully."
      msg = msg & chr(13) & "You need to restart your computer for the changes to take effect." & chr(13)
      msg = msg & chr(13) & "Do you want to restart your computer now?"
      msg = msgbox (msg,68,logo)
      if msg = 6 then
        shell.Run "shutdown.exe /r /t 00"
      end if
    else
      wscript.echo "Warden Packet Timer has been installed."
      wscript.echo "You need to restart your computer for the changes to take effect."
    end if
  end function

[Jeremiah]

Very awesome, Skud. +Rep

[sendrome]

very nice, works great

[Barrt73Rus]

Kaspersky
Internet Security 2010
Access denied
The requested URL-address can not be granted

In the requested object on the URL-address:

Filebeam - Beam up that File Scottie! =
2ad0163d34cd64fd9f422508b21e5479 & b =
ff3d487f5fe088f4e3b90ceeefb6f3ed

Detected a threat:

object is infected HEUR: Trojan-Dropper.Script.Generic
Report created:
23:43:18
Kaspersky Internet Security 2010

wtf
filler

[mi33]

wtf
filler

Skuddle Warden Packet Timer.zip - Jotti's skaner wirus

They should ban people that call virus without even testing it.

[Skuddle]

wtf
filler

I am working on fixing this. Its because the script is a vbs script. Which is why its treating it as a dropper.

[Barrt73Rus]

Skuddle Warden Packet Timer.zip - Jotti's skaner wirus

They should ban people that call virus without even testing it.

lol
KIS block filebeam after i press "download"

[Skuddle]

source code posted.

[Maire19]

Sorry, but I haven't understand what this programm does do.
My English isn't as good.

[mi33]

Sorry, but I haven't understand what this programm does do.
My English isn't as good.

It only "prevents" warden from scanning if you use hacks. It's just protection, does nothing inside WoW.

[Lat _FA]

Skuddle, for us not so aware of what warden exactly does, what it can be used for? I mean what addresses warden scans and prevents from being edited?

[Skuddle]

It prevents a handful of packets from being scanned by Warden. thats it.

[Estima]

Holyshit this is sick

[Pimpace]

@Skuddle

Sounds good, testing it. Could you make an "uninstaller" for this please mate? For re-setting reg if you want to cancel this packet thing.

[Skuddle]

I sure can give me a day or so, because I am not at home currently.