Updated: Blizzard Warns of Account Stealing Trojan Virus

Updated Fri, Jan 03, 2014 by Martuk

Update: Blizzard has posted a new update on the Trojan issue, explaining that it's being installed through a fake version of the Curse Client that is downloaded from a fake version of the Curse website, so if you're putting the client in, make sure that you're doing it from the right place. You can read the update from Blizzard below.

To summarize for those of you that haven't read the green posts:

-The trojan is built into a fake (but working) version of the Curse Client that is downloaded from a fake version of the Curse Website. This site was popping up in searches for "curse client" on major search engines, which is how people were lured into going there.

-At this point, it seems the easiest method to remove the trojan is to delete the fake Curse Client and run scans from an updated Malwarebytes. Should you still have issues, there is a more manual method that Ressie posted earlier in the thread.

-Thanks to Ressie's efforts, most security programs should be able to identify this threat shortly, if not by the time I type this.

-If you were compromised, follow the instructions here and we'll do our best to set everything right (as we always do).

-For those of you interested in these MitM style attacks, this is the only confirmed case we've seen in several years outside of the "Configuring/HIMYM" trojan in early 2012 that hit a handful of accounts. These sort of outbreaks are annoying, but an Authenticator still protects your account 99% of the time. Stay safe!

Original Story: A new virus is making its rounds around the web this week and it’s one of those creative ones that can land even authenticator protected accounts in a compromised situation. Blizzard recently posted an advisory to the World of Warcraft forums warning of the new Trojan, which acts in real time to steal both your password and authenticator information as you enter them to log in if your PC is infected.To aid players in investigating the issue, Blizzard also included a few steps that you can perform to see if your PC has been infected with the virus.

Thus far Blizzard has discovered that no anti-virus program seems to remove the virus. And given the nature of the beast, this could affect any of your games, so it might be a good idea to check out your PC out just to be safe. You can read how to do that in Blizzard’s full message below.

One other thing to note, as Blizzard also points out in another forum post, is that the virus may not even be visible until it goes active.

Source: World of Warcraft Battle.net Forums


Hello,

We've been receiving reports regarding a dangerous Trojan that is being used to compromise player's accounts even if they are using an authenticator for protection. The Trojan acts in real time to do this by stealing both your account information and the authenticator password at the time you enter them.

If your account has been compromised recently, I'd recommend looking for the Trojan. It can be identified by creating an MSInfo file and then looking in the Startup Program section of that file for either "Disker" or "Disker64". It will usually appear like this:

Disker rundll32.exe c:\users\name\appdata\local\temp\w_win.dll,dw Name-PC\Name Startup
Disker64 rundll32.exe c:\users\name\appdata\local\temp\w_64.dll,dw Name-PC\Name Startup

We are currently looking for more information on the Trojan. We have not been able to locate any anti-virus programs that will remove it besides just reformatting your system. If you have been recently compromised and find it on your system please reply with the following pieces of information.

Your MSInfo.
A list of any addons you recently installed along with where you got them.
A list of any programs you recently installed along with where you got them.
Any security programs you have run and their results.

News from around the 'Net