I should also add that surfing the web using Firefox with the NoScript plugin will make you a bit more secure. Internet Explorer is the biggest target for malware at the moment. It wouldn't help you in the case described above, but it'll give you some measure of protection when visiting regular websites.

I also use Firefox with NoScript (and Adblock), and am a religious user of the Ace Updater and I must say that the way this program is hard-coded to use the inferior and insecure Internet Explorer browser has always made me nervous that something like this would happen.

freeware opensource

arrows were not displayed. i'll use words instead :)

freeware is not opensource

Thanks, souvlaki. I was going off the comments in the sourceforge comment thread linked from the other thread, but it appears they closed the source after people complained about the ads. Pure ignorance.

http://sourceforge.net/forum/forum.php?forum_id=757575

Having Firefox installed and using it is not enough. You must make it your default browser too. Nothing is worse than allowing IE to pop up when you are not thinking about it.

most keyloggers/trojans do a memory scan making C&P passwords just as vulnerable as people who type them in.

None of those things would save you in this case.

And if you really think Copy-and-pasting is a viable way around keyloggers, I really think you should think that through. Because it's wrong.

I prefer sandboxie (which confines malicious scripts) over noscript. With the latter I always end up having to temporarily allow script on nearly every site I visit, which gets really old really fast.

"None of those things would save you in this case."

Wait wait Wait wait Wait wait.....WHAT?!?

So using a browser with no support for activex, disabling all pop ups and banner ads, and taking it a step further by not allowing flash or scripts to run would not save you?

Having security updates to software (antivirus, windows, java...) that use network protocols does not save you?

Using a strong password that is changed frequently does not save you?

Based on the nature of how key loggers operate a key logger by definition tracks keyboard input. Besides if the key logger reads all of your memory the person the key logger is sending the data to would have 1000's of lines of code to read threw. Do a memory dump sometime and see just how much readable data you can pick out.

Please do a little research on computer security before you babble out a response.

Naix, according to the Sourceforge thread linked from the Wowace thread, the program embeds IE to display the ads. So yes, running firefox won't save you.

The trojans don't capture a snapshot of your entire memory. They specifically grab the password out of Wow's memory space. They also capture the clipboard, and download all of your saved passwords from your browser.

Juju

I guess we should call every corporate company in the world and tell them "Juju said that security patches, anti virus, and strong password can not keep your systems safe."

Next we should call Symantec and let them in on the good news they can close their operations based on Juju's findings.

Lastly Microsoft will be happy to hear they can eliminate the windows update group because they are no longer needed.

Way to go Juju information security experts everywhere thank you for showing us the way.




BAHAAHHAHAHA!!!!!

Notice how I never said to USE wowace updater. If you use firefox to begin with so you won't be able to get a key logger.

Use http://passwordsafe.sourceforge.net/ to encrypt your password even in memory.

Naix, I'm simply saying that those things won't save you in this specific instance. They are of course good practice, and I frequently recommend them. However, you're coming off sounding like you're safe from this specific case if you do all those things, and there isn't any evidence of that. The sane path is to not use WAU at all.