*update* IMPORTANT: how to check to see if your PC has been keylogged.

great info guys, thanks! I checked my PC and its clean. I also have AVG on my PC, but even so I think I'll check the registry every now and then to make sure.
 
This is probably a dumb question, but does anyone know where to get a hold of the exe from this nasty little bug in a zip file or something? I want to rip it apart and attempt to analyze it on a secure system that lacks any sort of connection to find out who it's sending data to, these bastards need to be tracked down and stopped somehow.

I hadn't thought about this approach until today, Norton destroyed it all when it was picked up over the weekend, it'll be next to impossible to catch this one on purpose now that everyone's in an uproar trying to get rid of it.

The only reason I ask about the exe contained in a zip file is mostly for safety purposes, it's kinda like putting a hazardous chemical in a glass vial for analysis, as long as it's inside the container it can't hurt anyone.

I'm aware this sounds like a rather outrageous request and is probably against a QCDN rule, if so, mods please delete away. Anyone who is skeptical of my intentions, just ignore my post, don't waste time quoting it. My odd request is 100% sincere in that I wish to crack the exe open(coding-wise) and find some way to track the culprit(s) at the very least. I may not be the best programmer from scratch, but I'm not half bad at taking existing code and figuring out what makes it tick.

Any comments regarding this particular post, please keep them to PMs, I already know what kind of shit I'm asking for by posting this and would prefer to keep it between myself and those I've somehow bothered instead of cluttering up a useful topic with people flaming me for another one of my insane ideas.
 
this is the obvious answer but if you have a spare comp you could just go to ffxiah, somepage or so and click on every add on and extra link until you find it into your comp

you could try it with a separate computer that doesnt have ffxiah like a library ONLY IF you know you wont destroy it and know what your doing >_>;'
 
Khidir said:
this is the obvious answer but if you have a spare comp you could just go to ffxiah, somepage or so and click on every add on and extra link until you find it into your comp

you could try it with a separate computer that doesnt have ffxiah like a library ONLY IF you know you wont destroy it and know what your doing >_>;'
Click to expand...

I'm glad someone took me seriously on my odd request, but I've tried that approach, it seems they've elminated it from FFXIAH already.

Library computers suck in this area, they don't allow any downloads period, it's almost impossible to even check hotmail accounts there, I've tried several things there, you can't do much else but browse the library's web page and look up things in some reference material sites that are bookmarked.

Edit: This topic was worth giving a sticky to btw, seems to be very useful even for those that aren't "advanced users" when it comes to computers, it's a shame that people had to fall victim to the attacks for it to come to light though.
 
Last edited:
I'll check when I get home and change my password. Thanks for the information. Just curious, do any of the infected use firefox only? I have IE explorer disabled via dad lan proxy and only use firefox, and after hearing it was caused by a IE exploit (surprise surprise) I want to know if any firefox -only- users have been infected.
 
Guess this won't affect anything if i'm on ps2 version only? Was getting confused earlier reading Blabj's thread thinking if i went onto ffxiah I would get the virus then they'd take my account info from there or something since my login and pw are virtually the same as the ones for my FFXI account =(
 
StanDarsh said:
Guess this won't affect anything if i'm on ps2 version only? Was getting confused earlier reading Blabj's thread thinking if i went onto ffxiah I would get the virus then they'd take my account info from there or something since my login and pw are virtually the same as the ones for my FFXI account =(
Click to expand...

The trojan/keylogger needs to be present to gather the information, so using your ps2 should theoretically be safe since it'd be hard put to get a working virus on it. If your pc is on though, it can transfer information if it has it which may include your password if it has already obtained it.

Just do a scan for the files told to us and keep a good set of protection tools.

I use a good collection of protection and it works well for me usually.

Spybot Search and Destroy

AVG Virus Scanner

Firefox- Ad blocker + Noscript (Always a good idea to disable IE, go to internet options, I forget which tab exactly but it will have a "Lan setings" button in the lower right. Click it and check use proxy, just put in something like 0.0.0.0.0, this will effectively disable IE without removing it which is a pain and can never truly be done.)

Comodo Firewall

I also keep a few other useful programs:
Cleanit!
HyjackThis!
RegistryCleaner
 
Last edited:
Sanjo Renomitsu said:
The trojan/keylogger needs to be present to gather the information, so using your ps2 should theoretically be safe since it'd be hard put to get a working virus on it. If your pc is on though, it can transfer information if it has it which may include your password if it has already obtained it.

Just do a scan for the files told to us and keep a good set of protection tools.

I use a good collection of protection and it works well for me usually.

Spybot Search and Destroy

AVG Virus Scanner

Firefox- Ad blocker + Noscript (Always a good idea to disable IE, go to internet options, I forget which tab exactly but it will have a "Lan setings" button in the lower right. Click it and check use proxy, just put in something like 0.0.0.0.0, this will effectively disable IE without removing it which is a pain and can never truly be done.)

Comodo Firewall

I also keep a few other useful programs:
Cleanit!
HyjackThis!
RegistryCleaner
Click to expand...

Ah, thanks searched for it earlier, but nothing came up so I think I'm good.
 
question on pop ups. I use spysweeper's pop up blocker which pretty much stops anything in its tracks to my understanding. But even if a pop-up is blocked from you seeing it, does a virus attatched to it still leak threw?
 
Isac said:
question on pop ups. I use spysweeper's pop up blocker which pretty much stops anything in its tracks to my understanding. But even if a pop-up is blocked from you seeing it, does a virus attatched to it still leak threw?
Click to expand...

It shouldn't if your popup blocker isn't really dumb, however virus/trojans don't really have to come from a popup can still be embedded, so having a popup blocker doesn't guarantee safety.
 
Yea so..I had the rsbo.exe but nothing else..What do I do to make sure I'm safe?

I did all the things mentioned here, but, I somehow don't feel safe. >_>
 
Last edited:
When in doubt, Darik's Boot & Nuke to wipe the drive and a fresh install gives peace of mind.
 
ok i did the searches and nothing came up. im guessing that im good to go fully. i also switched to Firefox instead of IE and DL'd the recommended plugins.
 
Rannoch said:
Yea so..I had the rsbo.exe but nothing else..What do I do to make sure I'm safe?

I did all the things mentioned here, but, I somehow don't feel safe. >_>
Click to expand...

This happened to me too, but it was under Search Assistant on the registry, so it was only because I was looking for it earlier. To make sure you're safe, try manually checking for:

C:\Windows\System32\rsbo.exe
C:\Windows\System32\kb1ss1p.dll
C:\Windows\System32\kb1ss1p.sys

If they're not there, you should be safe! I'd still recommend doing a full scan and DLing most of the things they previously stated in this thread.
 
This may be of use: POL has the ability to require 2 passwords to log into an account. One on the PC to reach the point that you can use the password to log into it comepletely. both of these passwords are differant for me, so the only one I type in is a simple password , and the saved password doesn't need to be typed in (saved), and is much more complex making it harder to break. I have no idea if this works as a preventative measure, but any little bit can't hurt.

Just be sure to do the above-mentioned checks as suggested. I can attest that AVG has been my favorite virus scan since just after their beta-testing. I also use a US-government version of Norton. And I also use Firefox almost exclusively (though I have IE7 for those few sites that are "IE only")
 
Javir said:
This may be of use: POL has the ability to require 2 passwords to log into an account. One on the PC to reach the point that you can use the password to log into it comepletely. both of these passwords are differant for me, so the only one I type in is a simple password , and the saved password doesn't need to be typed in (saved), and is much more complex making it harder to break. I have no idea if this works as a preventative measure, but any little bit can't hurt.
Click to expand...

For most keyloggers this makes it safe, but a ffxi-specific trojan will have an easy time getting your password out without you even needing to type it in.
 
Zaltana said:
ok i did the searches and nothing came up. im guessing that im good to go fully. i also switched to Firefox instead of IE and DL'd the recommended plugins.
Click to expand...
Good man.


**** Firefox Users ****

I highly recommend you use AdblockPlus and NoScript extensions if you do not already. These are the plugins I recommended to Zaltana earlier this week.

**** Internet Explorer Users ****

Normally, I'd say "you're fucked", but there is always help.

1.) Use the Windows Firewall. START -> Control Panel -> Windows Firewall; enable. It will be annoying as everything for a while if you have *no* exceptions built in yet, but a mild annoyance is a small price to pay for extra security.

2) Run your AV software. Not only does AVG exist in free version, but so does ClamAV, which now also works in Win32 systems.

3) Utilize spyware/adware removal tools, as listed before. BitDefender, ZoneAlarm, AdAware, SpyBot-S&D, and even Windows Defender are all worthwhile tools to use for added security.


**** Opinion, and sabre-rattling from this point ****
One more tick mark for Linux :)
 
You must log in or register to reply here.
Back
Top