Keylogger

[Morgrym]

Don't know how many of you get addons at worldofwar.net, but, you might want to scan your system if you do.

Keylogger Found at UI Mod Site
Tsurani posted on 20 Dec 2006, 02:01 PM
If you visited ui.worldofwar.net in the last few days you might want to scan your hard drive with the latest antivirus definitions. We have been informed that at this time the key logger was removed from the ui.worldofwar.net homepage.

The key logger itself was in an iframe embedded from an ad that was running on their site

The key logger planted a file called ntldr.exe on your C: drive There is however ntldr.dll please do not get them confused. You need the ntldr.dll to boot your PC to a desktop. A great free online scanner can be located at Trend Micro

UPDATE:

It looks like the mod/add-on called Stats Sniffer was the culprit. Somehow the mod author was able to put an IFrame into StatsSniffer add-on title. As of right now the mod called StatsSniffer was removed from the site.

Always remember to update your Antivirus, Browser and Operating System weekly.

[Sargeras]

Curse had a similar keylogger in one of their media servers, which was apparently fixed today. These sites use advertisement services that need to do a better job at scrubing their files as people can make them do some nasty things like this.

Wowinterface.com is safe since they operate off of Monocle's backbone and is ad-free.