Dear visitors,
We would hereby like to send out an official warning to all our visitors of potential keylogging attempts through any type of messaging programs.
We have had several alarming messages about fake Clanbase links being spreaded via IRC and Xfire, using "clanbase-ggl" (DO NOT TRY) instead of the regular clanbase.ggl.com. Clicking these links have resulted in a keylogger being installed on a person's computer, stealing their cdkeys and possibly more.
We advice everyone not to click on any links of people you do not know or trust (this also goes for our website!) and to always be careful with links from people you do know.
In addition, to prevent people from being tricked into opening a fake link (like
http://www.google.nl, which could refer to a different website, as you can see), advanced linking is no longer possible on this website and will simply display the actual weblink.
As far as I know opening something let's say with FireFox, it won't let install anything unless I allow, so isn't it safe to visit the pages, just not run / install anything from it?
edited 2010-01-31 16:58:16
Normal clanbase links are like: clanbase.ggl.com/, the fake clanbase link with a keylogger had a - in the middle.
Don't post the link here but just tell me if this is the case. If its the link with a keylogger, I will give you some useful links that might help.
edited 2010-01-31 18:22:37
- Kaspersky 2010 Full Scan
- Hitman Pro 3.5
- Malwarebytes Antimalware
- SuperAntiSpyware
- HijackThis
- Spybot Search & Destroy
- CCleaner
Not an expert of course, so maybe some more knowledgeable people could give their thoughts.
Froster thought the keylogger stole the cdkey and then completely removed itself. I don't have any proof of this myself though, so I can't guarantee it.
If he was able to pull off something nastier like MBR based rootkits, I might have more tools at hand :)
Regarding the "self destruction" thing, I also think this one is more of a data miner than an actual keylogger.
criswOw got multiacount on this
Is it still possible to do it through a site that does URL shortening?
edited 2010-02-01 05:42:15
HKEY_LOCAL_MACHINE\SOFTWARE\Activision\Call of Duty 4\codkey
Owner of keystealer will recive a .txt file at his ftp or mail with your key.
edited 2010-02-01 19:40:58