OctoWow - Forums

Mithran wrote: Fri Aug 14, 2026 7:29 pm So I ran into issues running this on linux, here's what worked for me:
Go to wine prefix, C:\users\<name>\AppData\Roaming\octo-launcher\torrent-root
Copy the torrent file into qbittorrent or similar client, download the new files and overwrite into your existing install. Once the files were updated, I removed patches 6, 7, 8 and 9 from Data folder. Then it started without issue

username@localhost:~/Games/octo/drive_c/users/steamuser/AppData/Roaming/octo-launcher/torrent-root> ls -lah
total 8.0K
drwxr-xr-x  2 username username 4.0K Aug 14 17:01 .
drwxr-xr-x 13 username username 4.0K Aug 14 17:00 ..
username@localhost:~/Games/octo/drive_c/users/steamuser/AppData/Roaming/octo-launcher/torrent-root> 

Hondo wrote: Fri Aug 14, 2026 8:36 pm I've been looking into an issue with the latest Octowow launcher/update, and I'm hoping someone from the development team can clarify a few things.

I'm not claiming to be a malware analyst or security person, but I do have some understanding and something doesn't look right, and some of the behavior I'm seeing is concerning me, especially when the launcher was working without any problems prior to the update.

The biggest thing I'm trying to understand is why the launcher is spawning PowerShell with something along the lines of: powershell.exe -NoProfile -NonInteractive -EncodedCommand

I understand that there can be legitimate reasons for a launcher/updater to use PowerShell, and I'm not assuming right off that means the launcher is now malicious. My concern is the combination of PowerShell, an encoded command, and Windows Defender detecting the behavior.

Windows Defender is currently reporting: Trojan/PowExcEnv.RXH!MTB

As I mentioned, this just happened and appears to have started around the time of the latest update, which makes me very concerned.

So I'd really appreciate some clarification/info from the developers on the following:

What specifically changed in the latest launcher/update compared with the previous version?
Was the PowerShell/EncodedCommand functionality introduced or modified in this update?
What exactly is the encoded PowerShell command doing? Is there a reason the command needs to be encoded instead of being executed normally?
Why did developers chose to hide the actual PowerShell script inside an encoded string instead of passing the script in readable form.
Where are those files being placed? For example, does it use the OctoWoW directory, %TEMP%, %APPDATA%, %LOCALAPPDATA%, ProgramData, or somewhere else?
Does the launcher create or modify any registry entries, scheduled tasks, services, startup entries, or other persistence mechanims?
What domains/or endpoints does the launcher communicate with when starting or updating?
Does the launcher download additional executables or scripts after installation?

Please understand I'm not saying this is malware based solely on a Defender detection. False positives happen, especially with launchers, updaters, scripting, and software that interacts with other processes/CMD.

However, when the new update we just got freaks out my Defender detecting suspicious PowerShell behavior, I feel it's fair for me to ask what changed and why.

If this is simply a false positive caused by something legitimate/needed in the new launcher, I'd actually like to understand what is triggering Defender.

I'm very uncomfortable with being told to simply disable Defender or click allow without an explanation, and/or ignore of what the launcher is doing.

If a developer can explain the PowerShell command, what files are being created/downloaded, why the command is encoded, and why Defender is detecting it, that would help with clearing up the concerns.

I didn't want to wait for a reddit post. I'd appreciate a bit of a technical explanation.

Edited quesiton: I noticed a user was able to locate the update torrent in AppData\Roaming\octo-launcher\torrent-root and manually download the updated files with a torrent client. Is this the same update mechanism being used by the Windows launcher? If so what role does the PowerShell -EncodedCommand process play in that update process?

Thanks.