Hacked Accounts

madalchemist · Site Admin Joined: 20 Mar 2006 Posts: 637 Location: Sydney

Hey guys

Serious issue: some guildies, and generally alot of people that play WoW, have more recently gotten their accounts hacked into. How does it happen, and why has the number of hacks recently risen dramatically? I've been reading the forums a bit and it seems one of the biggest culprits has been some malicious webpages that have exploited IE's security vulnerability.

An example given has been that particular adverts on a mod downloading pages have downloaded/installed Keylogging software onto PC machines. Such things happen without you knowing, simple by visiting that page.

I'm posting to bring out awareness and suggest a few things that my aid you to identify whether you have this software running or not, and how to remove the threat. This is based on personal experience of having had a keylogger on my machine after downloading a mod for my laptop. Thankfully I use a Firewall which prevented me from losing my stuff.

The below is a bunch of known keyloggers that have been installed on windows machines, including myself.

Do I have a Keylogger on my machine?

1. Open Task Manager. (shortcut is ctrl-shift-esc)
2. Check Processes. Remember: svchost.exe is OK
3. Look for variations of svchost.exe: svch0st.exe, svhost.exe, schost.exe, svghost.exe, scvhost.exe, scv.exe, scvr.exe, g0ld.exe
4. Right click on it. Select "End Process" to delete those processes.

How to remove ability for Keylogger running?

(warning backup your registry before doing this)
1. Close down ALL applications on your desktop
2. Start -> Run
3. Enter "Regedit"
4. Navigate to HKEY_CURRENT_USER -> Software -> Microsoft -> Windows -> CurrentVersion -> Run
5. Look for the name of the process you just deleted. Delete that key entry. If it's not there then
6. Navigate to HKEY_LOCAL_MACHINE -> Software -> Microsoft -> Windows -> CurrentVersion -> Run
7. Look for the name of the process you just deleted. Delete that key entry.

How to prevent a Keylogger from accessing the Internet?

Use a firewall. I dont run any security software other than ZoneAlarm - my personal firewall. There's a free version located here.

When I got the Keylogger on my machine, I noticed as I logged onto WoW that something else "was running in the background". What happen a few seconds later was a ZoneAlarm alert popped up asking me whether I wanted to allow "svch0st.exe" to access the Internet, i clicked "No/Deny". If you dont recognise the process, just click "No/Deny". If it's "worldofwarcraft" process, then click "Yes/Accept".

I hope this helps.

ps. The vulnerability only occurs by use of Internet Explorer to surf webpages, and if you choose to use Firefox/Opera, you will be safe. But that does not mean Firefox/Opera are 100% secure, which is why you need a Firewall to continue to protect you.

Zul · Guest

I was just thinking about all our guildies we have been missing of late :*( Anyone have any updates as to how satay/vamp/fyre/who ever else got hacked, are goin? It has been a long time since i seen the above ppl online, it is kinda sad Sad

cross our fingers that noone else will fall victim to the dreaded key logger!!

Gorexxar · Joined: 22 Mar 2006 Posts: 212

I ate them...

No, as a geuss they probbly cancled their accounts and might wait till expansion. Kind of bums you out when all your hard work at getting the equipment is gone
_________________
- Gorexxar previous member of IV (Transfered to Jeublethos
- Tuttle - level 60 alliance Druid (Barthalius)