User Interface & Addons

Re: New keylogger posted this moring in wow addon files

Nimloth — Fri, 16 Mar 2007 21:27:31 GMT

Users:

Kalita, Kalitassa, Kiritel, Lisane originating from 83.108.157.69 have been banned by account and ip for uploading virii. IP address listed for others to be able to prevent themselves from this idiot.

Re: New keylogger posted this moring in wow addon files

diogolp — Fri, 16 Mar 2007 21:08:40 GMT

Kalitassa is back on uploading fake addons with virus and trojans.

Why not make it so that the authors of the addons do no have the power to edit or delete comments, just report them? This way, people can be warned.

Re: New keylogger posted this moring in wow addon files

diogolp — Fri, 16 Mar 2007 20:30:11 GMT

Just as a warning

Kalitassa, who is NOT the author of either addon, has just uploaded 2 trojan files named after Atlas and KTM, and he is deleting all the posts made on the fake addons page warning people about it

Re: New keylogger posted this moring in wow addon files

Vampyrate — Tue, 13 Mar 2007 17:37:32 GMT

> Eldredd wrote:
> Atlas is one of the most reputable and used addons for World of Warcraft. I guess I have to ask a few questions of you before you go blaming Atlas for getting you hacked.
>
> 1. Is this the actual version of Atlas from Curse or some off site one.
> 2. Was there a sort of executable in the file that you had to run to install

I echo this 100%. I've never heard of Atlas ever having this issue as it is one of the most reputable and longest running mods period.

Re: New keylogger posted this moring in wow addon files

dweebster24 — Tue, 13 Mar 2007 16:45:22 GMT

I totally agree. Not only is this happening to people in my guild, but WOW isn't doing enough to enforce and penalize people who steal money and hack accounts from people whether maliciously or for profit.

I believe that I had keylogging scripts installed from this site that send out emails and then phish your account for information. Luckily I caught it before replying, but I have been getting attacked recently. I am an adult, but I believe that this is common that people spread add on knowledge in game then turn around and harass the very people that they "help" not only harassing them via phishing emails and keylogging scripts stealing your personal information but also harassing you in game because they get banned for stealing your gold.

I could put up a list of addons but I am not going to bother as I don't know who it was. However, I think that some of the problems are that a quaranteen might be a good idea. Also lletting people only use certain formats and then there is not confusion about installing the addons particularly ones where you have to changed account information. I had a guy on here with a twinked rogue addon that looked great, but his instructions were atrocious and then he copped an attitude when I asked him to elaborate. I should have just reported the guy and his account addon crap but I let it slide and now I am hitting my head.

Re: New keylogger posted this moring in wow addon files

Shakari — Tue, 13 Mar 2007 06:47:53 GMT

> ramon1984 wrote:
> I got a question..
>
> like 3/4 months ago i had 60 priest full epic on hakkar.
>
> I got hacked pretty bad and lost all my items.. I downloaded al my addons from this site.
> I dont wanne start over knowing that it cna happen again because it rly sucks :P...
>
> Is it safe already tot play wow with addons again from curse?
> Or is there any scan tool or something else to detect if i hav ethis keylogger...
>
> mayb still on my pc? im gonne reroll new wow char on Saturday xD
>

yeah its dead simple ... don;t use any addon that involes and "EXE" file I don't use any exe files for anything that I don't know come from a reliable source.

Any normal mod loads after logging in anyway, so as long as it has no "exe" file in it your safe afaik

Re: New keylogger posted this moring in wow addon files

Eldredd — Sat, 10 Mar 2007 07:20:42 GMT

Atlas is one of the most reputable and used addons for World of Warcraft. I guess I have to ask a few questions of you before you go blaming Atlas for getting you hacked.

1. Is this the actual version of Atlas from Curse or some off site one.
2. Was there a sort of executable in the file that you had to run to install

Re: New keylogger posted this moring in wow addon files

Roobios — Fri, 09 Mar 2007 22:37:33 GMT

A few days ago I downloaded ATLAS addon which contained a keylogger embedded in the zip (virus scan did not pick it up, unfortunately). Within a few hours my WOW account pwd was changed and by the time I got back in to it, all my characters/items/gold were GONE.

Do NOT report to Blizzard that an addon got your account compromised or Blizzard will close your account for allowing someone else (even though unauthorized) to access your account (forbidden by the EULA you agreed to when installing WOW). If you report it to Blizzard, you'll likely end up loosing your account PERMANENTLY, as I did, for violating the terms of use for WOW.

Addons really enhanced gameplay for me with WOW..but I never considered the consequences and how addon use, while condoned by Blizzard, is also grounds for getting your account permanently banned, if Blizzard so chooses. BE FOREWARED and be careful.

After some research online, I've discovered that there are MANY unhappy ex-WOW users that have experienced similar circumstances. Be careful when asking a GM for help, as an "investigation" puts your account up for close scrutiny (your activity log) and is liablle to get your account banned for violating the "essence" (Blizzard's term) of the game.

Re: New keylogger posted this moring in wow addon files

piper13 — Wed, 07 Mar 2007 16:43:05 GMT

I don't have any of the mentioned files, but my account just got hacked on WoW, and I lost all the gear from a couple of 40s and a couple of 30s. That was really bloody expensive. Blizz says they're looking into it, but...

It was about 21 January when I DLd a bunch of new addons from here, and last Friday my account was mysteriously closed. When Blizz turned it back on, all my toons were nekkid (and Forsaken, especially when nekkid, don't look so good). It was just like being robbed; all my toons were parked by mailboxes, all my gear, money and bags from bank and inventory just gone. Even sold off my clothes.

There's a special place in hell, right in between child molesters and the furnace, for hackers.

Re: New keylogger posted this moring in wow addon files

Vampyrate — Sun, 04 Mar 2007 21:28:14 GMT

A keylogger was found in this mod too.
http://wow-en.curse-gaming.com/files/details/6668/pvp-enhancement-v5/

Re: New keylogger posted this moring in wow addon files

rowaasr13 — Thu, 22 Feb 2007 11:39:51 GMT

Even if programs are .exe they don't just magically execute themselves by being just placed on disk. Something must run them. So, imagine, it is hard enough.

Re: New keylogger posted this moring in wow addon files

CCGDood — Mon, 19 Feb 2007 16:25:30 GMT

Yes, but do you check every single folder in the zip to make sure it only contains .TOC, .LUA, XML files and doesn't have an .EXE, .COM, .SCR, .VBS hidden a few directories deep? I haven't gotten into programming AddOns yet but I can't imagine it is too hard to execute a program once the use has put it on their hard disk drive. .ZIP files are hardly more secure than .EXE installers.

Re: New keylogger posted this moring in wow addon files

321 — Mon, 19 Feb 2007 09:23:38 GMT

Personally I would never run an executable addon, addon developers should make sure to create a '.zip' version as well for the people that do not trust executable files, especially with all the keyloggers that have been appearing lately.

Re: New keylogger posted this moring in wow addon files

Goliathz — Sun, 18 Feb 2007 05:42:23 GMT

> Zinor wrote:
> > kadolar wrote:
> > It's getting so bad...
> >
> > Perhaps addons that are .EXE should be quarantined for a short period? Requires vetting from a 2nd curse-user? Someone with X curse points or less can't post EXEs ?
> >
> > Has to be a better way...
> I will actually consider something like this. We need a better way to control spammers since we can't obviously moderate the site 24/7 as sooner or later something will slip through while people are sleeping.
>
> With our next site push we are putting live levels with which we want to increase uses access on the site on a level basis. I will talk it over w/ the guys and see if we can't come up with a solution.

-points
-original poster of the first addon

Does curse-gaming not keep a log of the files that are uploaded and by who? If so, wouldnt a simple solution be just to ban the ip of the people of upload trojans?

I congratulate the staff of curse gaming for keeping the majority of the files that are uploaded clean.

Re: New keylogger posted this moring in wow addon files

huntinggopher — Wed, 14 Feb 2007 22:58:33 GMT

The best thing you can do is as soon as you down load an addon scan it with your AV and if possable you antispyware as well for not all key loggers fit under the virus catogory and hence not all are picked up by your AV.