RESOLVED! This thread will be useful to you if you use Ubiquiti security appliances, or any other advanced routers/firewalls. In a nutshell:
Blizzard has start doing something strange in Shadowlands which is tripping an Intrusion Prevention Rule in Ubiquiti called “ET MALWARE Netwire RAT Check-in”
Suppress this rule from the Unifi console and see if it improves your situation
The preferable resolution would be for Blizzard to stop doing whatever is tripping this rule
The second best approach is suppression based on destination (whitelist all blizzard IPs), but I don’t have a definitive list of WoW server subnets
homies let me know if you have any advice. for the last few weeks
wow lags and does not recover. i.e. wait 1 minute and it doesn’t come back. it happens in pretty much every single dungeon, sometimes multiple times
the game is not frozen, I can run around, I can see my animations, etc, but I cannot see anyone else moving
I can still send in-game text chat and others receive it
/reload doesnt help
i have to alt-f4 and come back in
I have disabled all addons that I don’t absolutely need. I have no new addons… same as always
[Update] I have disabled all addons and renamed the folder!
[Update] I have reinstalled WOW on another HDD - no improvement
[Update] WinMTR results below
[Update] My partner never experiences this issue, and is on the same network (plugged into the exact same switch, and I have replaced the Cat6 cable to my PC just to be sure.
It looks weird. You can’t just look at the end of it.
The first 2 hops show far fewer packets (2701 and 2879) than are received at the end (4616 and 4567). Along the way are sites that don’t show that many packets making it at all, which could be ICMP mitigation, or not.
I’d start looking at your home network given that it is recording only about 55% of the packets that are showing at the end of the run.
Edit - if that’s uniquity -unifi equipment on your home network, this thread may help.
And I realize you’re not on FiOS, but trying another packet type (not ICMP like WinMTR uses) may help if reset doesn’t do anything. For this I recommend using PingPlotter. More info can be found in my previous post to another player here:
Holy sh!t!!! Definitely running ubiquiti gear and definitely have IPS turned on. What is very very strange is my partner plays wow all the time and has never had this issue. Either way, I’m bypassing ubiquiti to test.
Thank you thank you thank. I was about to throw my PC out my window. And given the shortage of GPUs these days, I may have stopped playing WoW completely. But I have Ubiquiti gear, and I have IPS enabled, and I am SUPER HOPEFUL you guys are onto the problem. I just checked my IPS logs and found:
04/12/2021 3:32 pm Malware ET MALWARE Netwire RAT Check-in 34.123.149.90 : 3724 192.168.2.55 : 51799
This is the exact time that my dungeon “froze”… all graphics working fine, able to chat with team, but no one else is moving.
I WILL REPORT BACK!
Damn… look at the log from yesterday. I was actually RAGING with the “freezes”
Necro thread but I am having a similar scenario with Threat Management enabled on my UDM Pro. I have been able to play without issue but my wife gets these freezes and at the same time I get the ET MALWARE Netwire RAT Check-in alert from UDM.
For now I am suppressing the signature to “fix” the issue but Blizzard certainly needs to investigate this on their end as it is absolutely coming from their infrastructure. Here are some log entries from my UDM showing Blizzard subnets as the source.
Overview
Date
Feb 17 2022
Time
1:03 pm
Origin
Service
ET MALWARE Netwire RAT Check-in
Category
Malware
Type
A Network Trojan was detected
Source IP
34.83.151.72
Destination IP
10.0.1.42
Severity
Concerning
Activity
61.1 MB
Interface
br0
Protocol
TCP
Date
Feb 12 2022
Time
12:45 pm
Origin
Service
ET MALWARE Netwire RAT Check-in
Category
Malware
Type
A Network Trojan was detected
Source IP
34.71.115.248
Destination IP
10.0.1.42
Severity
Concerning
Activity
5.85 MB
Interface
br0
Protocol
TCP
Date
Feb 12 2022
Time
11:59 am
Origin
Service
ET MALWARE Netwire RAT Check-in
Category
Malware
Type
A Network Trojan was detected
Source IP
24.105.32.32
Destination IP
10.0.1.42
Severity
Concerning
Activity
2.13 MB
Interface
br0
Protocol
TCP
