Anyone who has an authenticator attached to their account should run a
search (and probably an antivirus scan in case it's on the threat list
already) immediately and ensure the file emcor.dll does not exist on
your computer. This file is one reported to be allowing hackers access to World of Warcraft accounts
that have authenticators attached to them. It's also possible there are
other variations of these suspicious files, so if anyone has additional
information please respond in the comments.
Based on this thread,
the file may be found in /users/username/appdata/Temp. Since the file
is fairly new (first mentions of it are only a few days ago), and the
common source is unknown, I urge everyone to not log in to World of Warcraft or the account management site until you've run a scan.
Confirm your computer is secure before using your authenticator,
because this DLL file is allowing hackers to crack through it and
access your account.
A warning sign that you're currently infected with this keylogger is
that WoW will say your authentication code is incorrect, even if you
know for sure you typed in the correct code. Thanks to Cameron for posting about this on the World of Raids forums, too.
- Home
- Downloads
-
Addons & Mods
Featured
World of Warcraft
6,152 Addons
-
Popular Downloads
- Top World of Warcraft Addons
- Top Minecraft Bukkit Plugins
- Top Rift Addons
- Top Skyrim Mods
- Top World of Tanks Skins
- Top Terraria Maps
- Top StarCraft II Maps
- Top Runes of Magic Addons
- Top Warhammer Online Addons
- Top The Secret World Mods
- Top Age of Conan Addons
-
- Curse Client
- Premium
- News
- Giveaways
- Forums
- Store
Comments
Of course once they get in the damage is done. Too bad they can't actually REMOVE the authenticator :P
But I mean, this isn't some random person stealing accounts. These are companies that make money off of doing it, so there is bound to be someone watching 24/7.
No they cannot, my girlfriend had to fill out a form and either email or fax it off to Blizzard in order for it to get removed. Now I can see why.
@Lucifersatan... i never had to fill out a form to remove it... to remove an authenticator u must first log in... then go the the authenticator page on battle.net after that you must give Blizz 2 consecutive codes to remove it.
Seriously, it's not the authenticator being hacked...
BTW Heydan, you are a moron. It is still the best investment you can make.
This one is new and searching for EMCOR.DLL is the best defense right now. Looks like my anti virus is at Feb 21st for new threats so figure a few more days of "OMG my account was hacked" in vent. I suggest guild leaders lock down their guild banks a bit for the next few days.
C:\Windows\xhunter1.sys Hidden Driver
C:\Windows\vtany.sys Hidden Driver
C:\Windows\xhunter1.sys Hidden Driver
C:\Windows\vtany.sys Hidden Driver
We may want to be more careful with what we do. This is actually getting me worried about my account..again.