🚀 go-pugleaf

DaFox wrote:
> While digging out a new addition to the Den, DaFox found a scrap of parchment. On it,
> pv+u...@pobox.com (PV) wrote:
> 
>> Super...@mindspring.com writes:
>>> A player got hacked, find out how it was done and what he used to find it:
>>> Blizzard CS forum:
>>> http://forums.worldofwarcraft.com/thread.html?topicId=108417129&sid=1
>> Some of his assumptions are wacky (mods can't connect to the network -
>> removing them was wasted time). Also, it's quite possible that the
>> keylogger showed up in tcpview as "wow.exe" without actually BEING wow.exe.
>> It might be purposely changing it's name to hide from the warden.
>>
>> Still, not a bad article, and, surprise, the keylogger traces back to
>> China. *
> 
> Another thing I can think of is somehow the keylogger re-mapped the auth-server
> IP/DNS list(s), or split it to send to both the true auth-server and the pirated IP.
> That way tcpview would show wow.exe making the " bad " connection. 
> Does wow.exe look for a locally stored IP/DNS set for the servers it connects to or
> is wow.exe hard-coded with the list of servers? 

nope, not hardcoded, take a look at realmlist.wtf:
set realmlist eu.logon.worldofwarcraft.com


I know you can change the entries in this file to connect to other 
realms (a blue confirmed this actually not too long ago with regards to 
the beta PTR server). But since you don't have an account there it won't 
help you normally.

Urs

-- 
Manotroth@Dun Morogh EU - Orc Shaman 70 - Mining & Axesmith
Blackhorns@Dun Morogh EU - Tauren Bear 70 - Skinning & Herbalism
Shadowblack@Dun Morogh EU - Tauren Hunter 39 - Leather & Alchemist
Ratoma@Dun Morogh EU - Troll Rogue 26 - (Dis)Enchantress
Melony@Scarshield Legion EU - Human Mage 16
Blackhorns@Sunstrider EU - Tauren Druid 30
Kickaha@Perenolde EU - NElf Hunter 35
and various others