Blizzard warns of World of Warcraft account-stealing Trojan

For years, Blizzard has endorsed its Battle.net two-step authenticator protection scheme as the best way for World of Warcraft players to prevent account theft. However, the company yesterday warned customers that it has discovered a malware program that can hijack player accounts even if they're using an authenticator.

The malware circumvents the two-step protection by stealing both the account information and the authenticator password at the time the player enters them, a Blizzard representative said. Ordinarily, players would obtain a one-time-use authenticator password from a keychain dongle that spits out a new six-digit code on an LCD display when users push a button. Blizzard also offers a mobile authenticator app that serves the same purpose.

Blizzard said users can see if their PCs are infected with the malware by creating an MSInfo file and then looking in the Startup Program section of that file for either "Disker" or "Disker64." As yet, Blizzard has been unable to confirm an anti-virus solution that will remove the program short of reformatting the system. While the company isn't certain how the malware found its way onto users' PCs yet, one common thread is that users reporting problems had recently downloaded addons for World of Warcraft.