Windows Defender treating our loader as a threat on first run is expected, not a bug. The loader does three things that look identical to malware from the outside: it rewrites parts of its own memory at runtime, it injects code into the Wardogs process, and it reads memory from a game it did not launch. At the machine-instruction level, a paid game tool and a credential stealer do the same work. Consumer antivirus engines cannot read intent, so anything matching that behavioural signature gets flagged.
Signature scanners (Defender, Malwarebytes, Bitdefender) usually show a red banner the moment the file lands on disk. Behaviour scanners (Kaspersky’s System Watcher, ESET HIPS, anything corporate-managed like SentinelOne or CrowdStrike) will quarantine partway through injection. Both reactions are normal for this class of software on an EAC-protected UE5 title.
Add a folder exclusion the safe way
Skip the process-level exclusion. The loader binary changes every time we rebuild against a fresh Wardogs update, and a rule tied to a specific file hash or name breaks the next patch. Point the exclusion at a dedicated folder instead, and keep only the loader inside it.
- Open Windows Security from the Start menu.
- Click Virus & threat protection.
- Under Virus & threat protection settings, click Manage settings.
- Scroll to Exclusions and click Add or remove exclusions.
- Choose Add an exclusion, then Folder.
- Pick a folder that holds nothing else. We recommend something short like
C:\WD\so the path is easy to check later.
Restart the loader after the exclusion is in place. If Defender still flags it, run a manual scan on that folder once to clear the quarantine record from earlier. Bitdefender, Kaspersky, and ESET follow the same pattern from their own settings panels: exclude the folder, not the file.
Fake cheat loaders wrapped around infostealers are a whole industry. If the file you are about to whitelist came from a Discord DM, a YouTube description, a Telegram channel, or any site that is not your logged-in account page on wardogshacks.com, delete it. Threat actors buy legitimate cheat brand names as search ads and hand out malware under a copied download button. The only trustworthy copy is the one behind your account login after payment clears.
Tell a real loader from a bundled fake
Three checks, in order. Any one of them failing means the file is not ours.
- Source. Log in on wardogshacks.com, open Downloads, and use the button there. No mirrors, no reuploads, no “faster link” from a stranger in chat.
- Checksum. Your account page shows the SHA-256 hash of the build we shipped for the current cycle. Right-click the file, open Properties, and on Windows 11 the File hashes tab shows it. Match it character for character. If the hash does not match, the file is not the one we published.
- Name and size. The file name on your account page is authoritative. If what landed on disk is 400 KB or 40 MB when the account page lists the build at roughly 12 MB, it is not our file.
If any of those checks fails, do not run it and do not exclude it. Reach out through the contact page and we will confirm the live build’s checksum for you.
Once the exclusion is set and the download is verified, the first-run flow is covered in install and first launch. For the deeper question of whether adding an exception on a kernel-mode anti-cheat title puts your Steam account at risk, see is it safe.