*Compromised accounts* Potential Trojan

  • We've been receiving reports regarding a dangerous Trojan that is being used to compromise player's accounts even if they are using an authenticator for protection. The Trojan acts in real time to do this by intercepting both your account information and the authenticator password at the time you enter them.

    If your account has been compromised recently, We'd recommend looking for the Trojan. It can be identified by creating an MSInfo file and then looking in the Startup Program section of that file for either "Disker" or "Disker64". It will usually appear like this:

    <code>Disker rundll32.exe c:\users\name\appdata\local\temp\w_win.dll,dw Name-PC\Name Startup
    Disker64 rundll32.exe c:\users\name\appdata\local\temp\w_64.dll,dw Name-PC\Name Startup
    </code>
    With the help of our awesome MVPs, we've identified the source and a method to remove this Trojan.

    The original thread can be found here, but to summarize for those of you that haven't read the thread and the related posts:

    -The trojan is built into a fake (but working) version of the Curse Client that is downloaded from a fake version of the Curse Website. This site was popping up in searches for "curse client" on major search engines, which is how people were lured into going there.

    -At this point, it seems the easiest method to remove the trojan is to delete the fake Curse Client and run scans from an updated Malwarebytes. Should you still have issues, there is a more manual method that Ressie posted earlier in the thread.

    -Thanks to Ressie's efforts, most security programs should be able to identify this threat shortly, if not already.

    -If you were compromised, follow the instructions here and we'll do our best to set everything right (as we always do).

    -For those of you interested in these MitM style attacks, this is the only confirmed case we've seen in several years outside of the "Configuring/HIMYM" trojan in early 2012 that hit a handful of accounts. These sort of outbreaks are annoying, but an Authenticator still the best option for additional protection and protects your account 99% of the time. Stay safe!