WinHoldem - Detection Avoidance

WinHoldem Home - Bring Home - WinPP Home

The Problem
Online poker casinos do not want you to run WinHoldem. Some poker clients actively attempt to detect WinHoldem on your computer. There is nothing you can do to control how far they will go to do this. If they detect WinHoldem you are essentially at their mercy. Their reactions can range from just simply closing the poker software to closing your account and possibly conscripting your entire bankroll.

The Solution
Stealth is the solution to the problem. A Stealth program is a remote window control application. Essentially, a stealth program is a very simple PCAnyWhere. Stealth gives you the ability to see a copy of a window that is running on another computer. You avoid detection by running your poker software on a machine where WinHoldem is not installed. And you use Stealth to let your WinHoldem machine see the poker window.

You need two computers
You must have physical access to two computers connected to a fast network such as a LAN. The idea is to run WinHoldem on one computer and run the online casino software on another computer. You then use a Stealth app to display a copy of the poker window on the desktop of the WinHoldem computer where WinHoldem will scrape the copy and run as normal.

We offer 2 stealth apps: Bring and WinPP
(bring is much better)


If you want absolute maximum chances to avoid detection, then make sure that WinHoldem is NOT installed on the casino computer. Technically speaking, there is nothing you can do to control exactly what the casino software can or cannot see on the computer where it is running unless you downloaded/installed all casino software to a restricted windows user account and you're running it from that restricted account. If you think you may have installed the poker site software into a privileged accont then you need to read the following section on Restricted Accounts.

Restricted User Account
Using Bring or WinPP or any other piece of stealth software for that matter is not necessarily everything you need to do to protect yourself. If you downloaded/installed the software from the poker sites while you were logged into a priviledged windows account (like Administrator), then when you run one of those poker clients (paradise,party,stars,etc.), it has admin privileges which means there is nothing it cannot do, nothing it cannot see, nothing it cannot read, nothing it cannot write; and this means that it will be able to see winpush.exe on the disk and in memory (as a process) even if you renamed it before running it. So the moral of this story is that you simply cannot hide anything from a privileged piece of software;

If you know that you did indeed download/install the poker site client software while logged into privileged account then all is not lost; there is a solution. You must completely uninstall all casino software that you downloaded/installed while logged into a privileged account. You must return your system to the state it was in before you downloaded any casino software. If you really want to be 100% sure then wipe your harddrive and reinstall the operating system from scratch; this measure is not usually needed but if you're able to do so then you should; Keep in mind that each of the sites write various cookies all over the place so there's really no way to know if you got it all by merely uninstalling; is it inconvenient to reinstall the operating system? yes it is; your decision depends on how safe you want to be?

Once you're at a clean state, you can then create a restricted windows user account that you will use for all of your online casino purposes. To learn how to create a new windows account just click start and help and then search for "new users". When you create the new account, you want to create it with maximum restrictions (which is usually the default but not necessarily).

Once you've created the restricted user account you can then simply login and begin the install process for each of the poker sites. We recommend creating a folder on the desktop called "casinos" or "poker sites" etc. and then installing any/all casino software to that folder; this will give you greater control over which areas of the disk are visible to the poker clients; at a minimum they need to be able to see their own install folder but not much more than that; you can use the NTFS file system that comes with windows to control permissions on folders and disks; just right click on any folder or disk in windows explorer to set the permissions;

Once you've installed the casino software to a restricted account, you can then run it as normal knowing that the operating system will prevent it from doing certain things - like reading the folder where winpush lives or reading the process space where winpush is running, etc. etc. But the only way that can occur is if you protect the winpush install folder using NTFS and you use the RUNAS command to gain elevated privilege before launching winpush

Running a program as another user
Here is the link to the Microsoft help documentation on the RUNAS command
what is the RUNAS command
You can also get help by clicking start/help and searching from runas. You must launch a renamed winpush.exe using the RUNAS command so that you can run it as a different user than your restricted account; and the reason you must do this is so that the operating system will prevent the restricted user account and any software it is running from reading information about the winpush process. If you run winpush.exe as the restricted user then any poker client software running under the restricted user account will be able to read the winpush.exe process and know that you are running winpush. The only way to prevent the poker client software from seeing winpush is to use the RUNAS command and execute the program as a different more privileged user. If you fail to prevent the poker software from seeing winpush then you will get an email from your site informing you that they have detected winpush/winhholdem and are taking such and such measures. Don't let that happen.

GOTCHA
There are 2 very separate and distinct events that must occur in order for you to run a program. First you must have access to the file given your current privilege level. Second you must then have privilege to run the program. Windows forces you to have access to the target .exe before it will apply your alternate runas user. This means that if you lock your stealth folder up tight (like you should) then you cannot runas winpush.exe directly from your restricted account because your restricted account does not have permission to read the stealth folder This may seem inconvenient but it is actually a good thing security wise so be grateful. The correct procedure is to runas on cmd.exe or windows iexplorer to first gain your elevated privilege and then after doing so move on to run winpush as normal - this means you can just exectute winpush normally without the runas command because you already have privilege to read it and run it.

If you don't like this 2 step process then your only other secure choice would be to always initially login to your privileged account so that you have access to your entire system by default and then you would priv down to the restricted user account when running the casino client. You can easily get windows to always runas for you if you set the property in the shortcut for the casino client. Just right click on the shortcut and find the "Runas" checkbox. Windows will then ask you for user name/pass whenever you click on the shortcut.

Always remember that the entire goal of this procedure is to guarantee that your casino client software runs in a restricted context so that it cannot see your stealth files either on the disk or in memory.

IEXPLORER SHORTCUT
Probably the most universal and convenient method for anybody is to simply have a shortcut to internet explorer with the runas option active so that at anytime you can explore/navigate as any user you choose. Here's how to do that:

1) Right click on your desktop to get the popup menu.
2) Left click on NEW to get the submenu
3) Left click on SHORTCUT to get the create shortcut dialog
4) Enter the full pathname to internet explorer
- i.e. "C:\Program Files\Internet Explorer\IEXPLORE.EXE" (if you don't know the full path then you can press the browse button and navigate to iexplorer.exe)
5) Left click on the NEXT button
6) Enter shortcut name that will appear on your desktop
- i.e. "IEXPLORE AS"
7) Left click on the FINISH button to create the shortcut on your desktop
8) Right click on the newly created shortcut to get the popup menu
9) Left click on PROPERTIES
10) Left click on the RUNAS checkbox
11) Left click on OK

You can now click on the "IEXPLORE AS" shortcut and windows will prompt you for user name/pass and when the browser window appears it will be running with the privilege level of the user account you selected.

12) Left click on the browser View menu and select Explorer Bar / Folders so that you can see your file folders.


Installing Bring
Visit the Bring home page for instructions on how to download and install Bring.

After Bring Install
For maximum safety, be sure to rename bring.exe on your casino machine to some other inoccuous name before executing the program. Make sure that the new name ends with .exe. You don't need to rename bring on your pokerbot machine.


Installing WinPP
Visit the WinPP home page for instructions on how to download and install WinPP.

After WinPP Install
For maximum safety, be sure to rename winpush.exe to some other inoccuous name before executing the program. Make sure that the new name ends with .exe. You should also, rename winpush.ini to some other innoccuous name (preferably the same name as the .exe). Make sure the new name ends with .ini otherwise winpush will simply quit when it cannot find an .ini file. It is also a good idea to select an inoccuous name for the winpush install folder but it is not necessary if you set the permissions on it's parent folder so that the casino software cannot read the contents. To set the permissions on any folder just right click on it to get the properties.

Step by Step
These steps assume that you have already installed all software - casino, winholdem, winpp.

stepcomputer?what to do?
1winholdemrun winpull
2casinorun poker lobby
3casinoopen a poker table window
4casino run winpush
(use the RUNAS command to priv-up)
select the poker table window
DO NOT SELECT THE PROGRAM MANGER
YOU MUST PUSH A SINGLE POKER TABLE WINDOW
(be sure to rename winpush.exe beforehand)

You should see the winpull window change to a copy of the poker table window. WinHoldem will be able to operate as normal on the copy.