If you get big enough, they will come ….

[Cairenn]

Originally Posted by shazzy I know of one person who has lost his account so far.

If it is confirmed because of having downloaded one of the two infected files from here, I am sooooo sorry.

[Seerah]

Originally Posted by Kaomie Anyway no big deal, like Seerah would say it is not like there is not 10 billions compilations available these days. Just one less will not hurt

If you recall my opinion on the subject, Kaomie, there's a difference between a "real" compilation and a "I can do that too!!!" compilation.

[Tekkub]

Originally Posted by Seerah If you recall my opinion on the subject, Kaomie, there's a difference between a "real" compilation and a "I can do that too!!!" compilation.

Agreed. There's far too many "I zipped up my addon folder to share it with my guildies" "compilations" and far too few compilations that take the time to write up an installer like yours. I hold nothing against the good compilations like that, it's the flood of "me too" compilations that only a dozen people download that I'm sick of.

[Dolby]

I agree as well, maybe we need to look at splitting up the compilation category. I dont want to get rid of the ones guilds put up here as it helps them, but we could definitely work on separating these two very distinct types of compilations.

[Dissonance]

Originally Posted by antiarc There is no specific task. The DLLs with the trojan code are embedded at runtime into lsass.exe, which is a valid system process.

I know I'm late, but I just figured I'd chime in with a small detail to help the (hopefully few) infected users.

Process Explorer - By SysInternals, a subsidiary of Microsoft IIRC (Link), It's free, by the way; allows you to see the DLL's that are hooked from EXE's running on your PC. I've used this feature numerous times on client PCs and seeing something out of the ordinary is an obvious tipoff if you're familiar with computers.



Also yes. My Computer IS named "CAKE".

[ScytheBlade1]

<3 Sysinternals <3

Footnote: wzcsvbc.dll doesn't pop up as resident in lsass.exe until a reboot.

[Tekkub]

Originally Posted by Dolby I agree as well, maybe we need to look at splitting up the compilation category. I dont want to get rid of the ones guilds put up here as it helps them, but we could definitely work on separating these two very distinct types of compilations.

To be quite frank, I'd love for them to be in their own little sub-site, far away from the "normal" addons I hate that the RSS feed is mostly compilation updates.

But I doubt you'll go to that extreme. So why not break compilations out a little bit into subcategories. Maybe "Personal packages" "Guild packages" and "Public Compilations" or something?

[Dolby]

Originally Posted by Tekkub I hate that the RSS feed is mostly compilation updates.

There havent been compilation updates on the latest feed nor on the front page for about 4 days now.

[Seerah]

I was wondering why it wasn't moving as fast as it used to...

[shazzy]

Originally Posted by Cairenn If it is confirmed because of having downloaded one of the two infected files from here, I am sooooo sorry.

aaah no Cairenn, I'm pretty sure he was using wowinc at the time. This keylogger has been going around for a long time to, it's by no means new so I wouldn't blame yourselves for this. You are every bit the victim as much as anyone else who gets it.

[Tekkub]

Originally Posted by Dolby There havent been compilation updates on the latest feed nor on the front page for about 4 days now.

/wuv

The hell? Too short? What else am I supposed to say. Stupid forum post length rules and crap.

[forsakenhollow]

I just want to know if the file is safe to install now and also i tryed to install the Rar file but when i log in says addon some thing some thing trying to call...and alot of the files are missin from it i was told by a friend so if u dont mind plzzzz help ty

[Zyonin]

Originally Posted by forsakenhollow I just want to know if the file is safe to install now and also i tryed to install the Rar file but when i log in says addon some thing some thing trying to call...and alot of the files are missin from it i was told by a friend so if u dont mind plzzzz help ty

If you are talking about Sewell UI, the current exe is clean however author will not be updating that due to the mess the crackers have made.

What mods are missing? Please tells us so we can point you in the right direction. I checked the rar and it appears to be complete with all the needed libraries and such included.

[Mazzlefizz]

Kao, please don't sell all my purplez!

[cheleness]

Thank you for the step-by-step on this. I too downloaded Sewellui within those dates and fell prey to the Invader virus. %*$* hackers deleted 8 of my toons along with a good deal of gold and items. I finally got rid of the virus with Avira AntiVir when several different antivirus could identify but not destroy it. Thank you for your humility and kindness in sharing what happened and helping those affected to fix the problem. There must be a huge number of us that got hacked. Blizzard's Account Administration department is slammed and it's taking a long time to restore my account. As always, I have to say Blizzard is responding promptly and professionally to my inquiries. Let's just hope I still feel this way after they have made their decision regarding my account.

-Rekeenin

[Kaomie]

Originally Posted by Mazzlefizz Kao, please don't sell all my purplez!

I have not even had a chance to log into the game myself yet, maybe all mines are gone

[bacon360]

Wowinterface has done a great job keeping the attackers out. First time in 5 years is great. I use WoWInterface because they are great at that. I will continue to use them too because of the detailed post and time spent getting a fix and making a write-up on it. Great job getting a fix out there. I learned a lot reading it. I didn't get infected I don't think but I am searching for those files anyways just to be sure.