Keylogger på addon-sites (CG, Worldofwar)

[ØysteinT]

Jævlene slår til igjen:

 

http://www.worldofraids.com/v2/

 

Account Security Warning: Addon Websites infected with keyloggers

 

 

Numerous threads have been popping up over the last couple of days about keyloggers embeded in Add-ons on Curse-gaming.com and worldofwar.net., lots of players got their account stolen. They have been detected in Addons and other parts of those two websites, according to users's testimony on boards.

 

For players who dont know, what's a keylogger and how dangerous it is for your WoW account, I will do a quick decription:

- Keyloggers record what you fill in at your account name and password and then send those data to the maker of the script. Therefore you will lose your account, since somebody else know your account and password information.

 

How to check if you are infected:

 

- If you have a file named ntldr.exe (EXE, not dll, the dll is used by your OS to boot your computer). That file is the keylogger and you should remove it asap.

 

How to protect yourself:

 

- Dont use Internet Explorer (It hasnt been confirmed that IE 7.0 was safe yet), instead download and start using Mozilla Firefox.

*Fore more security, since WoW targeted keyloggers use java in their process to infect you, you can block or allow java-script with the no-script add-on for firefox, It disables java on default and let you enable it on choice (for trusted websites).*

 

Where:

 

- WorldofWar.net: At this time, there is a keylogger embedded into the ui.worldofwar.net homepage. The keylogger itself is in an iframe embedded from hxxp://ui.bcegame.com/pps.exe (do not visit!).

 

- Curse-gaming.com: The curse-gaming keylogger is on media1.curse-gaming.com. If you go to their beta patch notes page from their site, everything's clean, but if you go to the one listed above, it's got the keylogger on it. (Source)

 

Source, testimony and more detailed infos:

 

- WorldofRaids: http://www.worldofraids.com/forum/viewtopic.php?t=2487

- Blizzard forums: http://forums.worldofwarcraft.com/thread.h...=58796664&sid=1

- IGN: http://vnboards.ign.com/wow_rogue_class/b2...00532144/p1/?13

 

 

Teza

WoR reporter

 

Og for den andre fra CG:

 

Edit 3: HOW TO CHECK IF YOU ARE INFECTED!!

 

If you have the file \Windows\System32\algetgleyus.exe DELETE IT!

 

Open regedit.exe and go to \HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and DELETE the key systwyei (this is what starts the executable each time)

 

ONLY REMOVE THOSE TWO ITEMS.

Endret 21. desember 2006 av ØysteinT

[nih]

Ah. Godt jeg bruker Opera.

[Rata101]

På Curse også: http://forums.wow-europe.com/thread.html?t...=99830333&sid=1

 

 

edit: CG var allerede nevnt ja... Posting før man er våken ftl.

Endret 21. desember 2006 av Rata101

[Rostad]

Var litt redd for at jeg hadde fått men det hadde jeg vist ikke

 

Mozzila Firefox<3

[LordArild]

Var litt svett, helt til det stod:

"Dont use Internet Explorer (It hasnt been confirmed that IE 7.0 was safe yet), instead download and start using Mozilla Firefox."

 

Firefox <3

[FredrikFtw]

Heheh.. God reklame for Firefox.

[gullf1sk]

Bump. Denne skal være øverst.

[zebe]

Glad jeg er en av de smarte som bruker Firefox.

[nd4spd]

Gjelder dette fortsatt?

[Lampeskjermen]

Gaaaanske sikkert på det, en IRL venn av meg som bruker IE ble hacka forrige uke da han hadde lasta addons fra curse..

 

Lasta samma addons som han for å teste det, skjedde ingenting ( <3 Firefox <3 )

[Anakin Skywalker]

Morro!

 

Der var grunnen til at jeg mistet kontoen min i går.. jaja, det måtte vel komme til slutt, er vel bare å vente noen uker før de gidder å svare meg fra blizzard support.