5/5 for a little while/where to go from here

After 3+ hours of dealing with SE... They told me they would send me a form to fill out, sign, and send back. Then the restore process could be started.

Inventory before hacking 80/80, 80/80, 80/80, 62/70...
Inventory after hacking 59/80(blm gear), 67/80(thief gear), 64/80(mnk gear & misc.), 36/70(pld gear)...

R/E items NPC'd Voyageur Sallet, Resentment Cape, Parade Gorget, Swift Belt. Still not sure what else has been NPC'd since I can't remember it all right away.

If you're in the market for a Novio, please know it isn't the RMT that stole mine before you buy it unless you don't mind funding them.

IS before 100k+, after 178...

Not counting Novio, the RMT got about 5-7 mil i'm guessing.

I'm not blaming anyone but myself. I'm still not sure how they got my info because I have swept my computer and found nothing. Nevertheless, they got it, and got my shit.

I might be back, might not, haven't decided what the fate of Shmedly and Glob are at this point.

I use Firefox, so the IE leak wouldn't have affected me unless they can use the leak if the program isn't used.

Peace,
Shmed
 
Firefox alone is sadly no guarantee for safety anymore. Only when it is combined with plugins such as adblock/noscript AND keeping your normal software such as flash up to date.
 
Shirai said:
Noone else that uses your computer?
Click to expand...
No one else uses this computer.

ramp said:
Firefox alone is sadly no guarantee for safety anymore. Only when it is combined with plugins such as adblock/noscript AND keeping your normal software such as flash up to date.
Click to expand...

I have adblock, didn't have noscript, and I do keep my software up to date.

Thanks for the info.

Peace,
Shmed
 
Does anyone else have access to your characters?
 
Pretty sure you'll keep whatever you have on you char as well. I know a few people that got restored and kept some of the newer stuff they had.
 
sorry it took me so long but try this:
Table of Contents:
Exploits found so far.

* smart.dll *
* taizi.exe *


NOTICE:

August 29, 2008

A new exploit has been found on FFXI Atlas... again.

Be sure to read Aikar's post here *.

Details of the exploit is explained in the following post:
(Source: http://exile.activeboard.com/index.spark?f...opicID=20303597)
Spoiler! --Click here to view--
QUOTE
The file is named taizi.exe located on the domain usa.ccxtt.com

It is saved to C:\explorer.exe and is executed from there.

it installs these files:

* c:\windows\system32\.dll - Trojan.PcClient-1603
* c:\windows\system32\drivers\.sys - Trojan.Dropper-10666
* taizi.exe - Unknown Dropper (Scanned; AV Did Not Warn)

Connects to Website (every 30 seconds) :
http://www.crackwg.net/pcshare/pc.txt
- [Contents of File = "59.34.148.248:7866"]

Also Attempts to Connect (Undetermined Amount of Time) :
http://59.34.148.248:7866/20080826/063853/753874.jsp (may be randomly generated)


I've added usa.ccxtt.com and crackwg.net to my hosts file so my pc can never reach that domain.

Win XP/Vista host file is found at C:\windows\system32\drivers\etc\hosts

Open it in Notepad and add these lines to it:

127.0.0.1 usa.ccxtt.com

127.0.0.1 crackwg.net

this tells your pc that those domains exist at your loopback address, so if a script (or browser, or anything) ever tries to access those domains, it will just be sending the requests to your own pc, rather than to the real sites.

more info here:

http://www.bluegartrls.com/forum/showpost....mp;postcount=30

(click the link on the upper right of that page to view the whole discussion thread)

also from that thread, you will find instructions on how to check 100% if you are infected:

http://www.bluegartrls.com/forum/showpost....mp;postcount=58

I dunno how many of y'all follow BG or other forums for this kinda thing so I wanted to pass it along.


Follow Aikar's guide on protecting your web browser here.

More details about the exploit is found here.



August 22, 2008


A new exploit has been found in Flash Player version 9.x and affects even the newest updated version, 9.0.124.0.

Source: http://secwatch.org/advisories/1021314/

It is HIGHLY RECOMMENDED that you follow the instructions posted here (Securing your computer & PlayOnline Account) on how to block Flash movies in either Firefox or Internet Explorer.

This is a preventive measure until Adobe updates Flash player plug-in.

Thanks to Aikar of the Windower forums for finding this out.
Click to expand...
 
sorry this happend to you, same thing is happening again this year as last year, but at least u get roll backs now. sad thing is ppl see these posts where the RMT are getting gil to sell and yet they still buy it.... its like buying a stolen radio that you know got jacked from someone you know.
 
matchuu said:
sorry this happend to you, same thing is happening again this year as last year, but at least u get roll backs now. sad thing is ppl see these posts where the RMT are getting gil to sell and yet they still buy it.... its like buying a stolen radio that you know got jacked from someone you know.
Click to expand...

Even worse when it's people recirculating the gil among rmt. :/

Sorry for your losses Shmed and good luck with whatever you decide to do.
 
Shmed ; ;

Good luck getting your stuff back bro. You're one of the coolest cats I know.

peace
Tim.
 
Lucki said:
Does anyone else have access to your characters?
Click to expand...

Only one person has my POL ID but i have changed the password a couple times since I gave it to them.

Psylentcuda said:
sorry it took me so long but try this:
Click to expand...

Thanks a lot for the info Psylent. I've checked everything according to that thread, but found nothing.

I did run Ad-Aware and found 1 file that looked suspicious, but that's about it.

This time around SE is making me print out, sign, and send back some silly ass form. Hopefully, they will get my char back to me in the next week or 2, but I'm going to guess it will be closer to 1 month.

Peace,
Shmed
 
My friend told me that there is something that have been going on through IE. He also said the same scripts were going through Foxfire, which I've been using for a while now. He said the safest way to go atm is going w/ Google Chrome. Can I get some input on this?
 
jyakotsu said:
My friend told me that there is something that have been going on through IE. He also said the same scripts were going through Foxfire, which I've been using for a while now. He said the safest way to go atm is going w/ Google Chrome. Can I get some input on this?
Click to expand...

A script is a script is a script. If it can run on IE and FireFox, I see no reason it wouldn't run on Chrome. Unless the script had to be tailored differently for the 2 browsers, I don't see how Chrome will benefit you more then the other two.
 
Is very likey you got hack from FFXIAH ads in there, sometime my symantec block attacker from ActiveX download, the recent one i have was trying to download some supecious pdf file into my system.

Oh, if your LS have forum also, it can also be attacked from there, my forum sometime trying to ActiveX download stuff into my computer too... just watch out next time
 
You must log in or register to reply here.
Back
Top