IMPORTANT! PROTECT YOUR ACCOUNT

[Wiebbe]

Guys, there are ALOT of keyloggers being spread at the moment. Some websites have been hacked and are distributing keylogger though internet explorer exploits. They will auto-install and log your password. worldofwar.net is one of those websites, so pay ALOT of attention!

Some things to keep in mind:

Always use the Launcher from blizzard. Dont launch the game directly but use the launcher panel, it includes alot of safety measures.
Change your password often, install a firewall (usually i am against firewalls, but perhaps now it is a good idea! www.zonelabs.com for a free version)
Check for the following running processes when you press control-alt-delete and then taskmanager:

svch0st.exe
g0ld.com
ntdetect.exe

And read up on : http://forums.wow-europe.com/thread.html?topicId=31483341&sid=1

[koetjeka]

damn I feel so vulnerable!

I'm always using the blizzard launcher (also for the news it shows every time) but I do visit worldofwar.net :S

From now on im going to change my passwor every week or so.

thanks for the info

[Melody]

I have atleast 6 svchost.exe - no 0 (zeroes) they are normal? (Melody = n00b)

I have hardware firewall in my modem

[Suzumiya]

Yes that's normal

[qbane]

As long as I dont DL anything I'm safe though right?

[koetjeka]

Well as far as I know, some websites install things on your pc without asking you

BTW, isnt it safer to use mozilla instead of IE?

and is the firewall from my router as good as a "software" firewall?

[Dalod]

No Quebeen, you can get it even if you dont download anything (or technically not, as if you visit a web page you download to your hard drive, and thus browsing is downloading, and thats kind of the mechanism being exploited only with a bit more complexity), It downloads and installs itself without your knowledge. Its therefore extremely important that you know how to prevent these kinds of loggers:

* Allways use a virus program on real time scanning with updated virus definitions! (EZ Antivirus is free)
* Allways run a firewall which ask you before any program starts sending and receiving content from the internet! (Norton have a really nice one which I use on my mainpc)
* Allways answer no to popping up questions on webpages, it doesnt matter if they claims Microsoft made the program, if you dont know the exact wording from the verification signature Microsoft uses, they can trick you, as they can with other similar organizations as well.
* Use a popup blocker to hinder scripts installing that way.
* Frequently remove spyware using a spyware search tool.
* Frequently delete temporary internet files.
* Set restrictions on accepting cookies in internet explorer and delete cookies immediately if you find a website and its behaviour suspicious.
* For advanced users you can check the IP logs on your modem/router to see traces of trojans and DOS use of your computer.
* If you have Norton, use the password program, it keeps the passwords safer then what windows do!

[Dalod]

also beware of running programs with similar names as lsass.exe and spoolsv.exe, those are oftenly used by trojans

[qbane]

Yea I removed lsass.exe today. A virus scan showed I had 2 Trojans (recieved through Java) and I removed those too. Just by googling the .exe task programs running (ctrl alt del) its easy to find out which should be removed or not, even for a noob-techie like me ;]

I prefer housecall to scan, has a virus and trojan and spyware check ftw ;]

[Valeron]

Your post looks professional Dalod, but my mama told me not to listen to any grey, old, crossdressing little men.

[Dalod]

Your post looks professional Dalod, but my mama told me not to listen to any grey, old, crossdressing little men.

Ssshheeeed....

I'm coming to get you....

[Dalod]

Yea I removed lsass.exe today. A virus scan showed I had 2 Trojans (recieved through Java) and I removed those too. Just by googling the .exe task programs running (ctrl alt del) its easy to find out which should be removed or not, even for a noob-techie like me ;]

I prefer housecall to scan, has a virus and trojan and spyware check ftw ;]

Still housecall is online scanning and not real time scanning, so unless you scan before every wow login you are not protected 

[Dalod]

Wiebbe: Do you know of TSPY trojan is used as keylogger for wow?

Found the TSPY trojan (which is a keylogger) using trend micro, it wasnt found using adaware and eTrust antivirus, so I'm guessing its rare or masked. Also very little information about it on internet, all I found is that it is actually a keylogger and that it runs hidden. Currently in the process of deleting the trojan and then changing all my passwords.

[Suzumiya]

Question: the keylogger does it steal the password from your browser (e.g. when you log in on the wow site) or from the WoW game itself (which I find unlikely ah well )

[Dalod]

A keylogger takes the keystrokes on your keyboard. Sp doesnt really matter where you write it, the keylogger recognices whats on the screen and then saves the keypressing you do.