Was an addon hacked?

Many of my guildies have been hacked recently. A guildie has figured it out. Screen shots are being taken and keylogging is going on during the hack.

He has norton 360 gaming version security and he has an authenticator on his account. He has gotten a level 5 security risk warning from norton when he trys to log onto WoW.

He figured out the cause by removing all his addons from his computer then putting them back on one addon at a time and then trying to log into WoW to see which addon gave him the level 5 secruity risk warning.

ReCount was the only addon giving him the secruity warning. All the others he could log onto the computer just fine w/out getting the warning.

His Norton secruity is also giving him this file name

c:/user/public/games/worldofwarcraft/scan.dll.new