So um.. wtf is this..

[Rannoch]

Broken

 

[Uzor]

I also sent this to my bf, he laughed on the phone and said its a hoax. he said same thing as guys in my office did but clearer. I'll try to repeat what he says;

"the page first of all wouldn't run on your machine through the web because of security within the browser preventing VB from running. however for argument, if it does execute, it does nothing but add all the numbers together to equal a larger number. whoever wrote the code is an idiot because they try to make it look complex by changing the orginal variable name. first it is, T, then it becomes I, then it stupidly becomes T again"

"the url to the test execute is useless and not even used, its just saying url is this then does nothing with it"

"tell your friends not to worry as its just junk code, being used as a hoax to scare people. nothing can be gained frmo it"

I trust my bf as this is what he does, but if you like, run it by the Windower people, they will know too.

Well, Redx DID got hacked. He sent me a tell in-game and said he can't make it to Dynamis today because all of his gil and items are missing. So it was sent by someone who hacked him. So I'd rather be on the safe side

 

[Redx]

ok... first off WTF IS GOING ON!!!!

thanks to Neo for sending me a /tell about this, of course i noticed something odd about my account when i logged in and getting strange /tells from a person i didn't know freaked me out alil but Neo seems legit.

ok so, i use windower (the lite version, V0.99 of Azaril's Windower), an update a while back stopped the current version so the lite was released as a temporary measure untill they could update. the lite version doesnt support plug-ins btw.

other then that i have never used a hack or even downloaded any...

i dont know who or how my account was hacked, only 1 person has my account details and he is a real life friend for many years so i dont even suspect him at all.

missing items:

Apollo Staff
Wind Torque
Scorpion Harness (new ;
lots of other stuff but i dont think anything else was worth over 500k,
1 million gil was in the delivery system when i checked... it vanished before i had a chance to check the name :banghead3:

of course i'm really fucking pissed off about this and any help will be very much appreciated

GM call has been placed... will up date later.

edit: SoB's even took my Woodmans Ring and Jester's Cape +1

 

[Kea]

Something kam sent me,

he said the person who owns this website and possibly wrote script is email is:
kele1999 (at) vip.163.com

if that helps to report anything at all

 

[Rannoch]

A good thing to do is camp ffxiah.com for the items, and see if the same person sells all the same items that were stolen.

 

[Redx]

the link was also sent to Fubio

 

[neophytal]

i got that tell too, and i just said "i dont understand" lol

i wouldnt ever go to that site.

 

[Redx]

ok, so far the tell has been sent to ppl i dont know and in all likelihood have never met...

no GM yet, i'm hoping they can at least find out who my gil was sent to and do something about it

 

[Orestes]

The fact that he was hacked, and the hacker himself sent URL's to people on our server is evidence enough that you guys probably have something on your machine.

<script language="VBScript">url = "http://www.tochinese.cn"</script>

This is what you want to worry about. Keystroke loggers can be bundled with executable files, and placed on your machine without you ever knowing it. They are then installed remotely. They can also be bundled with a Trojan. No telling in this case.

Internet browsers cannot execute .exe's, but that doesn't matter if this is the case. All you had to do was visit the page with this in the source code.

If you clicked that link, don't type in any sensitive information like your POL ID, and don't view anything in POL thats sensitive. Kystroke loggers not only log keystrokes, but some can also take screenshots of what your viewing.

I searched google and there are programs that remove keyloggers. You can try pctools.com.

 

[Blabj]

Very sneaky bundling the keylogger into a phished site of a company (NCSoft) who do actually make MMOs.

They're making Aion the game at the moment, I can't wait for that...

 

[Artem]

that is by far the most retarded code I have seen in my life lol, you guys don't really have anything to worry about if you click it

that code just adds up numbers and vbscript won't do anything except maybe in IE but even then it shouldn't have any effect

this seems like some asian kid that thinks he learned to "hack"

I bet if downloaded the test.exe just shuts down your computer everytime it starts up or something silly a 12 year old can make nowdays

EDIT about that whole url="blahblahblah"

it did not download anything it did not even attempt or even execute a file, any with highschool/business level of programming in BASIC or FORTRAN should know that's just a string variable being defined, that's all it is, it's a variable. Variables do absolutely nothing. All that code does is scare people who know absolutely nothing about programming. It's not like it loaded the file, even if it has a keylogger, linking to it doesn't get it on your machine, you physically have to transfer the data to your pc for it to be on your pc (you don't have to necessarily run it, just have it on your pc). He probably figured some people will download it after looking at source code. I'll get it later on my crash rig and reverse engineer it to see if it actually does anything but move numbers around.

 

[Redx]

The fact that he was hacked, and the hacker himself sent URL's to people on our server is evidence enough that you guys probably have something on your machine.

This is what you want to worry about. Keystroke loggers can be bundled with executable files, and placed on your machine without you ever knowing it. They are then installed remotely. They can also be bundled with a Trojan. No telling in this case.

I guessed that to, but because the only FFXI related tools i downloaded are the windower and AltanaView, both of which i've had for a very, very long time i cant think of were i could of picked one up.

i use a few FFXI related sites, i'm sure you all use the same ones, FFXIAH, somepage, wiki, KI (for shits and giggles), other then that nothing has changed for the years i've played FFXI.

done talking to GM, pics to come but you all know nothing can be done...

 

[Nycon]

That sucks you got hacked ; ; another reason i'm glad I play on the 360...

 

[Kea]

Good evening everyone,

My name is Kam and I am only using Kea's account here to communicate across my findings rather than passing the information through her. I am by no means an anti-viral expert but I am a designer and programmer so I hope that the following information is helpful.

***Please do not download or run the EXE file indicated within the script shown below. It contains highly malicious code acting as a trojan and further causing your operating system to occasionally malfunction.***

Below is my steps to tracking down what this problem is. If any of you have downloaded this program, please deleted it immediately. If you have run the program, you're in big trouble and will have to take many steps to cleanse your system.

I downloaded the EXE to test machine we have here at my department and executed the program. Visually, nothing happens although there is hard-disk activity and process usage. With the aid of Filemon (http://www.microsoft.com/technet/sysinternals/ProcessesAndThreads/Filemon.mspx), I was able to track the programs' activities.

Further study into the activities of the program indicated that it was reading a lot of system settings and configuration data and also lead me to its replication event. By use of the WINDOWS EVENT VIEWER, I was also able so see activities on the system.

It had created a file within the WINDOWS directory and a SERVICE runtime to automatically execute itself.

I disabled the services but was unable to delete the replicated file until I had rebooted.

Next, I did some research into the files' replication name and found the following.

http://www.google.co.uk/search?hl=en&q=Windows%5Cgj.exe

Which soon lead me to a FREE online file scanner: http://www.kaspersky.com/scanforvirus

Which reveiled that it did indeed contain malware.

http://www.viruslist.com/en/viruses/encyclopedia?virusid=139573

Details of the virus Packed.Win32.NSAnti.a were not very conclusive at this website so I went on to other anti-viral website to track down the programs description.

Trojan.Win32.NSAnti.a

http://research.sunbelt-software.com/threatdisplay.aspx?name=Packed.Win32.NSAnti.a&threatid=89157

So, do not download or run this program, if you have done either or, please feel free to contact me via Kea's website by emailing [email protected].

I hope everything is alright. Contacting the Gamemasters and PlayOnline Support is a good idea, I also recommend changing your POL account password if you have the ability to do so - I am unsure.

Do not be so concerned about the earlier script seen on the website source code. That code will not do any harm. The EXE will.

Kind regards and happy gaming, Kam.

 

[Zerayla]

Not to sound like a total idiot here, but when you guys say "keylogger" is this a program that you download to your computer to remember your passwords?

Or is this something that "automatically" is available on your computer? I know that for work for example, sometimes my login names (not passwords though) are remembered but I think this has something to do with "cookies". Or sometimes when you're searching for something on google, when you type the first few letters it will bring up a scroll down menu with other names that are similar that you have searched recently.

Is that considered to be a keylogger? I'm not too computer savy when it comes to things like this, so just wondering.

 

[Redx]

thanks Kam/Kea, i've been trying to follow the trail myself but its going nowhere, I'm more or less certain its a key logger but still cant be sure where it came from and how it got on my PC un-noticed.

I'm not a programmer myself but i work in IT and have never had a problem with my home system till now >.>

looks like FFXI was a weak spot... the things ppl do for gil :shok:

 

[Uzor]

that is by far the most retarded code I have seen in my life lol, you guys don't really have anything to worry about if you click it

that code just adds up numbers and vbscript won't do anything except maybe in IE but even then it shouldn't have any effect

this seems like some asian kid that thinks he learned to "hack"

I bet if downloaded the test.exe just shuts down your computer everytime it starts up or something silly a 12 year old can make nowdays

EDIT about that whole url="blahblahblah"

it did not download anything it did not even attempt or even execute a file, any with highschool/business level of programming in BASIC or FORTRAN should know that's just a string variable being defined, that's all it is, it's a variable. Variables do absolutely nothing. All that code does is scare people who know absolutely nothing about programming. It's not like it loaded the file, even if it has a keylogger, linking to it doesn't get it on your machine, you physically have to transfer the data to your pc for it to be on your pc (you don't have to necessarily run it, just have it on your pc). He probably figured some people will download it after looking at source code. I'll get it later on my crash rig and reverse engineer it to see if it actually does anything but move numbers around.

Yes, I'm well aware what it does. But I'd still prefer being on the safe side and not go there. For all know he might be very skilled and have something else hidden there and only use that stupidity as a cover to make people laugh.

 

[Artem]

woah NSAnti family virus's are a bitch to remove from the system

Kam did it replicated to this file as well kerne121.exe?

I'm gonna explain to you guys what NSAnti virus's do. They were designed to steal game information. It was originally designed for Lineage, but it is basically just a keylogger so it can be adjusted to any game. It will replicate itself (usually) to this name kerne121.exe *but by Kam's findings this is modified version that replicates itself to gj.exe* ALSO this is very important it doesn't make only one file!!!

It makes a copy of itself that is registered as a service, also it creates a .BAT files that deletes a file. I'm not positive on which file it would delete for FFXI. On Lineage it created $$A$$.bat

Also it would normally just register itself as a startup thing, but it's clear that whoever designed this one, recoded it as a service tool.

In addition, there will be a DLL file called microsoftie21.dll (unless changed by this code) that is registered and used in the actual virus. This DLL contains the stealing code and will steal the following information:

Computer information (hardware profile, windows keys, user names, passwords etc)
Login Information to Lineage(FFXI in this case)
Keylog strokes when Lineage is present (FFXI again)
All log files you basically have related to whatever it wants

ALSO, this test.exe is packed, this means it's a compressed and encodded installer so your virus scanner might not have picked it up if you ran it just on the test.exe

If you are ran test.exe you are more or less fucked if you logged into ffxi since than.

I'm not a network specialist, I'm not sure I can track where it is sending information to, but there must be a centralized server where all of these are reaching out to.

If you ran it what you want to do is immediatly remove gj.exe from services and run any and all virus scanning programs you have.

After that use a program to delete gj.exe on reboot (ccleaner for example). Do not just delete it, it will reappear again and mostlikely under a different name. It must be deleted on bios reboot.

Than you want to use a program such as jvpowertools to scan the registry for any gj.exe keys

It does not modify any windows files and it should be safe after it is completely gone from services and your harddrive.

 

[Artem]

Also to repeat, what Kam said, *the code is safe and does nothing, but if you ran the test.exe you are being monitored*

 

[Redx]

seems not only was the URL sent out a shitty attempt to hack ppl (shitty as in you'd have to be an idiot to run an .exe in that kind of situation) but was a great attempted to get me hit with the ban stick ^^;

the URL was sent to alot of ppl, enough to get me banned...

pics of a useless GM conversation still to come (trying to get access to a friend FTP).