🚀 go-pugleaf

Super...@mindspring.com writes:
>Another thing I can think of is somehow the keylogger re-mapped the auth-server
>IP/DNS list(s), or split it to send to both the true auth-server and the
>pirated IP.

Interesting idea - like a proxy server. Could be.

>That way tcpview would show wow.exe making the " bad " connection. 
>Does wow.exe look for a locally stored IP/DNS set for the servers it
>connects to or
>is wow.exe hard-coded with the list of servers? 

I'd be willing to bet it's the latter - they probably use domains.

>Is the keylogger rewriting that list or possible doing something to the
>windows Host file maybe ?

I seem to remember that someone described how local servers work, and it
sounded a lot like that. If you simply changed where wow.exe went, and
played man-in-the-middle with the traffic - ouch. *
-- 
* PV   something like badgers--something like lizards--and something
       like corkscrews.