This guide is written on the US forums by Shorticus of Spinebreaker. It covers some stuff that should be common knowledge to seasoned gamers and internet junkies. On the other hand, I’ve seen many people lose their accounts, some even IRL friends that should have known better. My personal advice for the readers, before i present Shorticus guide is: Use Firewall, Antivirus, Firefox + NoScript addon, and your common sense, since no software can offer a protection against human recklessness. Always be wary and paranoid when it comes to ’strange’ links and files! Even if you use authenticator for battle.net (wow etc), those warms will drill holes in your system, so you’ll have to either fix it, or reinstall. In anyway, it is work… so, it’s better to be safe, then sorry! :>

• What’s a keylogger?

See the links at the end of this post, please.

-A very short post containing a link and very little text
-A topic in a forum that it has nothing to do with (ie, a post about mages in the death knight forums)
-A post in a topic it has nothing to do with, a non-sequitur, or a post that doesn’t mean anything

• These are all indicative of keyloggers because keyloggers are generally hard-coded with one or two messages which they then spam at random. Having little text makes it more likely that random chance causes the message to have something to do with the topic. It also makes you curious to see what’s in that link and makes it more likely that you follow it (and, thus, get infected)

- Broken english

- Links that APPEAR to link to WoW fansites

• Look at the link text you’re using. Many keyloggers will use things that look like reputable WoW fansites such as wowhead, mmo-champion, worldofraids, and similar, but have additional stuff at the beginning, substituted letters (capital i in place of lowercast L, the letter o switches with the number 0, etc), and similar. Do not blindly copy and paste; down that path lies account theft.

-Post history is the same post over and over

• Since keyloggers are just posting the same thing over and over on a program, the keylogger’s recent post history, if they’re actually a keylogger, will probably be dozens of instances of the same post. You can find a poster’s post history by clicking the small magnifying glass next to their character icon.

-Deja Vu

• In the instance of topics, if you see a topic in one forum, then go to another forum and see exactly the same topic, it’s probably a keylogger.

-Outdated Subject

• If the person posting the link is talking about a horribly-out of date issue like the upcoming WoTLK release, patch 2.4, something that’s already in game being leaked, or similar, it’s almost definitely a keylogger.

-Read the topic!

• If it’s an active thread, every post after the keylogger will probably have people pointing out what exactly it is.

-Sexual Content

• I know you’re probably an easily excited 13-year old who’s just discovered internet naughty pictures and thinks they’re the greatest thing ever, but if someone posts a link and claims it’s a picture of something naked, sexy, or naughty in any way on these forums I can give you a 99.99% guarantee it’s a keylogger. Don’t click it.

-SPECIFIC EXAMPLE: “Leaked T7/T8 bonuses”

• The most complex keylogger currently circulating the forums involves multiple keylogged accounts. The one starting the topic posts the link; the next 5-6 posters will be the other hijacked accounts posting responses as though the link is credible; in this case, talking about a supposed website containing the set bonuses for T7/T8. The order the accounts post in is rotated in order to prevent the “cloned post history” issue. Since it appears to be a legitimate conversation, it lowers suspicion, and also means posts alerting to its keyloggerness will be pushed very far down the page.

What to do about it:

-Use a more secure internet browser!

• Internet Explorer’s older versions have tons of security holes the websites keyloggers link to will exploit. More recent versions fill some of these holes. The Firefox browser (especially with the Noscript addon) is fairly secure; as are others, as they generally stop “hidden” downloads that a website invisibly begins to install files on your computer without your knowledge.

- When in doubt, DON’T CLICK THAT LINK!

- You can live without seeing what might be a picture of someone’s big crit or a website with ‘good news!’ on it.

- If you clicked it, change your password IN A SECURE FASHION, and do not log onto the WoW forums or WoW servers until you confirm your computer is clean.

• “In a secure fashion” means “On a different computer which you’re sure is secure.” If you are already logged into the game or forums when you click the link, the keylogger cannot get your password; you have to type it in on your keyboard for it to find it (hence, ‘keylogger’- it records your keystrokes).

Run antivirus and anti-malware programs immediately

• Run your most up-to-date antivirus checker, preferrably more than one. Adittionaly, several freely available programs such as Ad-aware and Spybot search and destroy specifically check for this type of program.

Last resort: Never come to these forums again.

I’ll miss you.

RELEVANT LINKS:

Official blizzard statement on keyloggers: http://forums.worldofwarcraft.com/thread.html?topicId=1778038509&sid=1

Account compromise information center: http://forums.worldofwarcraft.com/thread.html?topicId=3773308319&sid=1