2026-08-14 Client Upgrade

[Zatarracro]

i cant remuve the ignore updates box in mods so non of them are on.

[Denin]

On a spare computer as i am not home atm, but everything worked fine pre patch.

Post patch i had to update my graphic drivers to get it to work due to all the mods being forced active. (to be fair updating drivers was not a bad thing)

But i can imagine this causing a lot of problems for people.

I also have some superwow API issues after the patch, getting normal shift looting to work that is.

I've managed to get it to work on a couple chars but the setting needed for it to work was different on both and neither setting did what it said it would do.

On a 3rd char i only managed to get normal shift looting on mobs but manual looting on herbs.

I can say it did not behave like this pre patch.

All that said i appreciate the work the Octo team is doing and managing to increase the quest log, superb work there! I always assumed that was impossible.

[Vesoralla]

I'm getting the DXVK thing popping up and can't run the game.
EDIT: Nevermind, disabling the dxvk mod helped. I can run the game now.

[Tambran]

i have reinstalled full game... now its running

[Sofakingboss]

with all the weird posts reporting that the game isn't working after latest update i was thinking i'd be in maintenance mode for a while today, i updated from octowow launcher to 1.3.6, restarted launcher, updated client; now i'm in-game getting over 400fps so i think its working fine and no crashes at all; also quest log shows up to 25 quests so that's a nice addition, good update thanks dev team

[Reiker]

With a fresh install & default launcher options I get this VanillaFixes error:

DLL entry point returned an error (0).

Make sure you have a compatible game client (1.6.1-1.12.1).

https://i.imgur.com/OSoaVP1.png

[Mithran]

So I ran into issues running this on linux, here's what worked for me:
Go to wine prefix, C:\users\<name>\AppData\Roaming\octo-launcher\torrent-root
Copy the torrent file into qbittorrent or similar client, download the new files and overwrite into your existing install. Once the files were updated, I removed patches 6, 7, 8 and 9 from Data folder. Then it started without issue

[Hondo]

I've been looking into an issue with the latest Octowow launcher/update, and I'm hoping someone from the development team can clarify a few things.

I'm not claiming to be a malware analyst or security person, but I do have some understanding and something doesn't look right, and some of the behavior I'm seeing is concerning me, especially when the launcher was working without any problems prior to the update.

The biggest thing I'm trying to understand is why the launcher is spawning PowerShell with something along the lines of: powershell.exe -NoProfile -NonInteractive -EncodedCommand

I understand that there can be legitimate reasons for a launcher/updater to use PowerShell, and I'm not assuming right off that means the launcher is now malicious. My concern is the combination of PowerShell, an encoded command, and Windows Defender detecting the behavior.

Windows Defender is currently reporting: Trojan/PowExcEnv.RXH!MTB

As I mentioned, this just happened and appears to have started around the time of the latest update, which makes me very concerned.

So I'd really appreciate some clarification/info from the developers on the following:

What specifically changed in the latest launcher/update compared with the previous version?
Was the PowerShell/EncodedCommand functionality introduced or modified in this update?
What exactly is the encoded PowerShell command doing? Is there a reason the command needs to be encoded instead of being executed normally?
Why did developers chose to hide the actual PowerShell script inside an encoded string instead of passing the script in readable form.
Where are those files being placed? For example, does it use the OctoWoW directory, %TEMP%, %APPDATA%, %LOCALAPPDATA%, ProgramData, or somewhere else?
Does the launcher create or modify any registry entries, scheduled tasks, services, startup entries, or other persistence mechanims?
What domains/or endpoints does the launcher communicate with when starting or updating?
Does the launcher download additional executables or scripts after installation?

Please understand I'm not saying this is malware based solely on a Defender detection. False positives happen, especially with launchers, updaters, scripting, and software that interacts with other processes/CMD.

However, when the new update we just got freaks out my Defender detecting suspicious PowerShell behavior, I feel it's fair for me to ask what changed and why.

If this is simply a false positive caused by something legitimate/needed in the new launcher, I'd actually like to understand what is triggering Defender.

I'm very uncomfortable with being told to simply disable Defender or click allow without an explanation, and/or ignore of what the launcher is doing.

If a developer can explain the PowerShell command, what files are being created/downloaded, why the command is encoded, and why Defender is detecting it, that would help with clearing up the concerns.

I didn't want to wait for a reddit post. I'd appreciate a bit of a technical explanation.

Edited quesiton: I noticed a user was able to locate the update torrent in AppData\Roaming\octo-launcher\torrent-root and manually download the updated files with a torrent client. Is this the same update mechanism being used by the Windows launcher? If so what role does the PowerShell -EncodedCommand process play in that update process?

Thanks.

[Justsomeguybro]

So I ran into issues running this on linux, here's what worked for me:
Go to wine prefix, C:\users\<name>\AppData\Roaming\octo-launcher\torrent-root
Copy the torrent file into qbittorrent or similar client, download the new files and overwrite into your existing install. Once the files were updated, I removed patches 6, 7, 8 and 9 from Data folder. Then it started without issue

For some reason, this appears to be failing for me as there is no update torrent in the directory:

Code: Select all

username@localhost:~/Games/octo/drive_c/users/steamuser/AppData/Roaming/octo-launcher/torrent-root> ls -lah
total 8.0K
drwxr-xr-x  2 username username 4.0K Aug 14 17:01 .
drwxr-xr-x 13 username username 4.0K Aug 14 17:00 ..
username@localhost:~/Games/octo/drive_c/users/steamuser/AppData/Roaming/octo-launcher/torrent-root> 

I also see an update was sent out for the launcher, but for some reason this file is not being generated/downloaded. I'll try and run a manual verification to see whether this catches it or not, but even the client folder doesn't exist, so the symlink it's trying to load is pointing to 'dead air'.

[Lanrien]

I've been looking into an issue with the latest Octowow launcher/update, and I'm hoping someone from the development team can clarify a few things.

I'm not claiming to be a malware analyst or security person, but I do have some understanding and something doesn't look right, and some of the behavior I'm seeing is concerning me, especially when the launcher was working without any problems prior to the update.

The biggest thing I'm trying to understand is why the launcher is spawning PowerShell with something along the lines of: powershell.exe -NoProfile -NonInteractive -EncodedCommand

I understand that there can be legitimate reasons for a launcher/updater to use PowerShell, and I'm not assuming right off that means the launcher is now malicious. My concern is the combination of PowerShell, an encoded command, and Windows Defender detecting the behavior.

Windows Defender is currently reporting: Trojan/PowExcEnv.RXH!MTB

As I mentioned, this just happened and appears to have started around the time of the latest update, which makes me very concerned.

So I'd really appreciate some clarification/info from the developers on the following:

What specifically changed in the latest launcher/update compared with the previous version?
Was the PowerShell/EncodedCommand functionality introduced or modified in this update?
What exactly is the encoded PowerShell command doing? Is there a reason the command needs to be encoded instead of being executed normally?
Why did developers chose to hide the actual PowerShell script inside an encoded string instead of passing the script in readable form.
Where are those files being placed? For example, does it use the OctoWoW directory, %TEMP%, %APPDATA%, %LOCALAPPDATA%, ProgramData, or somewhere else?
Does the launcher create or modify any registry entries, scheduled tasks, services, startup entries, or other persistence mechanims?
What domains/or endpoints does the launcher communicate with when starting or updating?
Does the launcher download additional executables or scripts after installation?

Please understand I'm not saying this is malware based solely on a Defender detection. False positives happen, especially with launchers, updaters, scripting, and software that interacts with other processes/CMD.

However, when the new update we just got freaks out my Defender detecting suspicious PowerShell behavior, I feel it's fair for me to ask what changed and why.

If this is simply a false positive caused by something legitimate/needed in the new launcher, I'd actually like to understand what is triggering Defender.

I'm very uncomfortable with being told to simply disable Defender or click allow without an explanation, and/or ignore of what the launcher is doing.

If a developer can explain the PowerShell command, what files are being created/downloaded, why the command is encoded, and why Defender is detecting it, that would help with clearing up the concerns.

I didn't want to wait for a reddit post. I'd appreciate a bit of a technical explanation.

Edited quesiton: I noticed a user was able to locate the update torrent in AppData\Roaming\octo-launcher\torrent-root and manually download the updated files with a torrent client. Is this the same update mechanism being used by the Windows launcher? If so what role does the PowerShell -EncodedCommand process play in that update process?

Thanks.

Now I'm also a bit concerned about this part.
But could it have anything to do with the torrenting part of the launcher now? There is a "ac2" or something along the lines, a program used to share files (torrenting basically), which could be legitimate use case to unload the load, but I'm unfamiliar with how that would relate with your concerns.

I also understand its frustrating from the dev POV having to explain these things but I want to believe that in the spirit of the weekly fireside chats that are had, that this isn't too annoying to clarify I suppose.