PWSteal.warcraft (runs as mspass***** and fucksnow*****)

[ragefire]

On Sunday I formatted my computer, installed WoW and downloaded http://www.cosmosui.org/index.php?p=download&f=Cosmos_Release.zip

These, besides the OS, were the only two things on my system. The download of the UI was the ONLY download done.

I installed and ran the updater executable.

24 hours later my account was stolen via the current password, which I never shared and all my gear sold to vendors. Blizzard is currently investigating and hopefully will refund for me.

Now, I take full blame for not having my virus definitions up to speed and my firewall poorly configured (both are corrected now) as they would've stopped --

http://securityresponse.symantec.com/avcenter/venc/data/pwsteal.wowcraft.html

But the fact remains that all signs point to getting this trojan from the only executable run on my system, which was received from this site.

Please scan your files and verify you aren't handing this little gem out with your release version. As I said before, I cann't "prove" where I got the trojan from.. but it was a freshly formatted drive, an OS install from a Microsoft CD (non-pirated), with a single website visit and download.

-rage

[Gryphon]

I can guarantee that this did not come from the Cosmos distribution or exe if you got them from this site or an official mirror.

[ragefire]

Good to know -- but I did get the UI from your downloads page link and it was the ONLY download done on my box after the format.

I'll take you at your word, but it is certainly strange.

[morbid_o]

Good to know -- but I did get the UI from your downloads page link and it was the ONLY download done on my box after the format.

I'll take you at your word, but it is certainly strange.

these forums would literally collapse under the weight of the complaints if it was widespread.

sorry to hear about it though, I've seen some nasty virii these days...