...I don't trust Wowhead anymore.

Slapperfish · **Posted:** Wed Apr 04, 2012 3:25 pm

I honestly don't think I'd ever hear myself say that.

Yes, it may sound very wierd to many of you, and it even sounds a bit odd to myself. But I have a completely viable reason to my statement. Be warned, however, if you're going to proceed reading this post, you may find yourself on-edge with Wowhead as well.

Keep in mind I do not have an authenticator YET. However, I will likely be recieveing mine in the mail in the next couple of days, as I talked with Blizzard over the phone about putting some of the money I used for buying a game card toward an authenticator (yes, they're more than happy to do that for you). You may call me crazy all you want for not having an authenticator as of yet, but I have merely made this post as a word of warning to those who share my current lack of one.

So, the majority of us know that Wowhead features model viewer that uses Flash, and an alternate, more enhanced version that uses Java. Anyway, it all started out when I attemped to start up the Java player version of the site's model viewer a long while back (I believe it was during WotLK, and the Java feature was relatively new IIRC). After a bit of waiting, a Java-related window came up, saying something along the lines of "Do you want to allow Java to run this application from the following site? (followed by some WoW-related site name I can't remember)" followed with the choice of "Allow" or "Don't Allow". I pressed allow, safely making it into the Java model viewer... Or so I thought.

At some point within the same week, I looged back into WoW, only to notice I was hacked via keylogger. Normally, I'm very cautious of what sites I'm on, and I wasn't on any suspicious web pages to my knowledge. So, I scanned my computer with Microsoft Security Essentials, which found a keylogger in a Java-related folder. I removed it from my system and contacted Blizzard to restore my account.

Fast forward to about a few months later, wherein several more keyloggers had slithered onto my computer, and costing me several more talks with GM's. Every time I found a keylogger, it was more or less Java-related and placed in the same main folder. In my frustration, I throught that uninstalling Java would solve the problem once and for all... Ohhh how wrong I was.

Upon coming back to Wowhead's model viewer without Java installed, the default option was stuck to Java for some reason, and the same exact window came up again. This time however, I pressed "Don't Allow". Go figure that just a week later, I was hacked for the umpteenth time, only this time, the keylogger placed itself in a Temporary Internet Files folder as opposed to Java. However, the keylogger was no different this time, as it was STILL Java-related.

So I had correctly guessed that the Java portion of the model viewer was the source of the problem, regardless of having Java or not, and regardless of my descision during the Java window. But I couldn't set the model viewer to show up with the Flash version by default, so I just prevented myself from looking at the feature altogether.

At some point, my account's game time was near expiration (I buy 60-day game cards), and I hadn't been playing WoW or checking Wowhead in the meantime due to being hooked on other games. I still scanned my computer with Essentials out of skepticism of the keylogger coming from elsewhere. But nothing showed up; my computer was completely safe for now.

Vowing to never look at the Wowhead's model viewer again, no matter how big my urge was, I came back to Wowhead, not to look at items, but to look at news articles, guides, etc. due to not having checked the news page in quite a while.

One week later, roughly a few days before my game time expired, I recieved a legitimate E-Mail from Blizzard about my account being closed due to excessive amounts of hacking. Frustrated for the final time, I scanned my computer like mad, and sure enough, it found the same old keylogger. I called Blizzard over the phone once more after I had gotten my act together agiain, who looked over the standing of my account, which in fact, was hacked to an extreme degree this time. They said they would clear the ban, and that the next time I bought a game card, I could call them into putting some of the money towards buying an authenicator.

Eventually, my account status was restored, and I recovered my account for the umpteenth time. But I had lost my complete and utter trust for Wowhead in terms of safety; I'd had it up to here ,(>_<)'¯ with keylogger problems. I just couldn't trust Wowhead anymore. If I couldn't even browse a newspage without getting a keylogger, how could I possibly be any safer viewing the rest of the site?

TL;DR - Don't go on Wowhead if you don't have an authenticator. Believe me.

Junrei · **Posted:** Wed Apr 04, 2012 4:22 pm

Um Slapper? You probably shouldn't access the internet entirely if you don't have an authenticator. You could get a keylogger from here too(we've seen an increase in gold spam bots lately). Also it helps to have a good virus scanner and stuff like Spybot. Not really WoWHead's fault if your stuff didn't identify it as a threat and Blizz has been advising for everyone to get authenticator. If you don't have one(which you can get for FREE on your phone), then that's no ones fault but yours. Not trying to be mean or nothing, I just don't have sympathy for anyone who gets hacked and doesn't have an authenticator after it's been advised to do so for what...a year and a half now? Longer? Doesnt cost much for the physical one(6.50 at the blizz store) and you can get a free one for your phone. So.....not many excuses to not have one, you know?

I do hope you get your stuff back though. It sucks that it happened just you had many chances to prevent it.

pengupuff · **Posted:** Wed Apr 04, 2012 4:44 pm

Congrats on getting your account restored, that sounded scary.

Echoing what Jessibelle said, you can pick up a keylogger from pretty much anywhere. Wowhead does not have a deliberate underground operation bent on ruining players' accounts, so once you have your authenticator set up, you should feel free to browse that site as you please. :]

Jadein92 · **Posted:** Wed Apr 04, 2012 5:56 pm

This isn't the first problem Wowhead has had, a few years ago both my parents computers got viruses that fried the whole system from wowhead. My dad was idiotic enough to go to it on the spare so all 3 computers were dead. I'm glad its only a keylogger your dealing with.

Galaxy · **Joined:** Sat Jan 28, 2012 6:47 pm **Posts:** 308

Hey, no hating on the lack of authenticator. Remember that thing with iPhone authenticators being hacked? Eh? 12 of my guildies got hacked and it was that little loophole. All within a few days of each other.

So, don't hate. I know that prob has been fixed, but no hatin'.

TY, OP, for the heads up, though! There ARE ppl out there who don't have one for various reasons and need to know!

Worba · **Posted:** Wed Apr 04, 2012 6:58 pm

Hmm, good to know. Though I can say, that the one time I was hacked, I'd been using wowhead for at least a year or so (and there were other factors which I won't go into here that made it extremely unlikely wowhead was the culprit even then); now that having been said, I got an authenticator immediately afterward, so who knows... maybe things have changed at wowhead since then, and me none the wiser since I'm now behind an authenticator...

Niabi · **Posted:** Wed Apr 04, 2012 7:31 pm

It should be noted that when you first removed the Java folder from your files and spoke to a GM to have your account restored, you should have also changed your password and possibly rerouted your game account to an alternative email provider - this would've prevented/helped lessen the subsequent attacks.

The keylogger would've had access to all your log-in information when it first installed, and thus would've been able to access your account again and again using the same email and password. It's also a good idea to change your email password from time to time since that also is connected to your WoW account. Also, never ever use the same password for all of your accounts. For good measure, you should have a unique password that you use only for the game and no where else.

Azunara · **Posted:** Wed Apr 04, 2012 8:21 pm

It sounded like Java was part of your issue here. I'd like to point out that the BIGGEST reason people get hacked isn't because of going to bad sites--it's because their anti-virus/Adobe Flash/Java isn't updated. If your Java was having issues (Namely, the keylogger was coming in through Java), that was likely your problem--it wasn't updated. By removing it, I figure you only made the problem worse.

I'll recommend here and now that you should ALWAYS keep Flash/Java and whatnot updated, because Viruses and other nasties will very easily come in that way. I also suggest ad-block for anyone and everyone. I love ad-block. It protects me from all the bad flash banners. <3

Junrei · **Posted:** Wed Apr 04, 2012 8:30 pm

Azunara wrote:

It sounded like Java was part of your issue here. I'd like to point out that the BIGGEST reason people get hacked isn't because of going to bad sites--it's because their anti-virus/Adobe Flash/Java isn't updated. If your Java was having issues (Namely, the keylogger was coming in through Java), that was likely your problem--it wasn't updated. By removing it, I figure you only made the problem worse.

I'll recommend here and now that you should ALWAYS keep Flash/Java and whatnot updated, because Viruses and other nasties will very easily come in that way. I also suggest ad-block for anyone and everyone. I love ad-block. It protects me from all the bad flash banners. <3

^ This. Update your stuff regularly. Can't stress that enough.

Zuilu · **Posted:** Wed Apr 04, 2012 8:38 pm

Agreeing with most of what others have said here, though I would like to point out, we haven't always had authenticators, and we managed somehow back then =P Infact, the only time I've ever been hacked, is during my time of having an authenticator. To avoid compromising your account security, it's really more on your virus scanner and being smart about what you download/click on. Authenticators will help, but you can manage -just fine- without one.

Wain · **Posted:** Wed Apr 04, 2012 9:33 pm

Not a lot of sites use Java, so it could easily appear to be a Wowhead issue simply because that's one of the few sites that you visit that does, even though it's simply a Trojan on your machine sitting and waiting for you to use Java somewhere.

I think if it was Wowhead, which would have to have one of the highest usages of any WoW-related sites, the complaints would be rife and it'd even make news sites.

Slapperfish · **Posted:** Wed Apr 04, 2012 9:44 pm

Well in any case, my authenticator is on its way and should be at my front door within the week. Once I finally do get it, I'll do all the Wowhead-ing I wanna do. I'm just playing it safe until then because of the conclusions I've come to.

AdamSavage · **Posted:** Wed Apr 04, 2012 10:29 pm

You try using Avast Anti Virus free edition Slapperfish. It probably would of caught these key-loggers.

Slapperfish · **Posted:** Thu Apr 05, 2012 1:49 am

So, after a bit of conversation with a friend the other day who had coincidentally came across something similar on Wowhead (but never got a keylogger from it), he said he went ahead and checked the WoW forums about it. He came across a post dated about 7 months ago where someone had the same problem. Turns out, it isn't Wowhead, but the advertisements on there that exploit out-of-date Java players. Wowhead apparently has no control over which ads they use to fund their site, but they will normally remove "bad" ads if they get them.

Additionally, I use Internet Explorer as my browser, so I'm much more vulnerable to viruses and keyloggers.

...I really oughta make the switch to Google Chrome or something.

Junrei · **Posted:** Thu Apr 05, 2012 3:12 am

Firefox is pretty safe. but yeah IE is really not safe to use. Thats why most people kick it to the curb and get FF and GC.

AdamSavage · **Posted:** Thu Apr 05, 2012 3:43 am

Slapperfish wrote:

So, after a bit of conversation with a friend the other day who had coincidentally came across something similar on Wowhead (but never got a keylogger from it), he said he went ahead and checked the WoW forums about it. He came across a post dated about 7 months ago where someone had the same problem. Turns out, it isn't Wowhead, but the advertisements on there that exploit out-of-date Java players. Wowhead apparently has no control over which ads they use to fund their site, but they will normally remove "bad" ads if they get them.

Additionally, I use Internet Explorer as my browser, so I'm much more vulnerable to viruses and keyloggers.

...I really oughta make the switch to Google Chrome or something.

That's your biggest problem right there. Firefox plus Adblock will get rid of Ads.

Melentari · **Posted:** Thu Apr 05, 2012 5:14 am

AdamSavage wrote:

Slapperfish wrote:

So, after a bit of conversation with a friend the other day who had coincidentally came across something similar on Wowhead (but never got a keylogger from it), he said he went ahead and checked the WoW forums about it. He came across a post dated about 7 months ago where someone had the same problem. Turns out, it isn't Wowhead, but the advertisements on there that exploit out-of-date Java players. Wowhead apparently has no control over which ads they use to fund their site, but they will normally remove "bad" ads if they get them.

Additionally, I use Internet Explorer as my browser, so I'm much more vulnerable to viruses and keyloggers.

...I really oughta make the switch to Google Chrome or something.

That's your biggest problem right there. Firefox plus Adblock will get rid of Ads.

All this, and get the addon called NoScript. It blocks all Javascript except the elements you specifically tell it to allow. It's brilliant.

Andine · **Posted:** Sat Apr 07, 2012 2:31 pm

I suddenly feel glad their Java model viewer is just plain crashing on me immediately upon start.

Morven · **Posted:** Wed Apr 11, 2012 11:34 am

It's generally smart to disable Java and Flash entirely and just re-enable them for specific trusted things, these days

And yeah, bad ads are a problem; they're the cause of a lot of problems, and of course someone wanting to account-hack would put bad ads up on Wowhead ...

Slapperfish · **Posted:** Mon Apr 16, 2012 1:11 am

Dear Wowhead anomalies:

Sincerely,
Slapperfish >*)))>{

P.S. DAMNIT JORMY I TOLD YOU TO STOP HOGGING UP THE SCREENSHOT!

WoW Petopia Community

...I don't trust Wowhead anymore.

Who is online