Virus infected Fraps steals account information?
DeathknightWoW has received a high number of reports of hacked accounts today. We have traced the Trojan to Trojan.Crypt.FKM.Gen. This Trojan has been known to steal WoW login information.
What we believe has happened, and please take this with the appropriate grain of salt, is that Fraps had a modified version of SpyLocked in it, which installed the Trojan.Crypt.FKM.Gen into Microsoft Net Meeting, which was then started silently when Windows rebooted. When the users logged into WoW, their passwords were key logged and twelve hours later several level 70 characters, including many bank alts, were deleted. It should be noted that it is possible that SpyLocked was installed into Fraps via a malicious email, however that is unlikely. We can also not verify where Fraps was downloaded, however it was almost assuredly downloaded from the official site.
This is evident in the logs of the virus scanner, which show both Fraps and Net Meeting as having viruses. Further, SpyLocked has been known to install further malicious programs on a computer. Finally, all of this has been confirmed via extensive interviews with the hacked subjects.
What can you do to prevent this from happening?
Two things:
- Change your password, now!
- When you’re at home, run a complete virus scan. Do not sign in to WoW until you’ve done so.
We’ve alerted the makers of Fraps to the problem, and if appropriate, will post their reply.
Most of all it’s important that you, our readers, stay safe. Take a minute to change your password now.
Virus scan readout:
C:\Fraps\fraps.exe
[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/FraudTool.SpyLocked.J
C:\Program Files\NetMeeting\mstinit.exe
[DETECTION] Is the Trojan horse TR/Crypt.FKM.Gen
Tags: 2, 2008, 4, Alts, at, att, Death, DeathKnight, ea, files, Interview, Interviews, IT, Knight, La, mail, media, Newsitems, OD, r, rap, reader, W
